Spam Calls and Phone Number Privacy Guide: Block Robocalls and Keep Your Number Private

Spam calls and texts keep coming because your number is cheap to find, easy to fake and costs scammers almost nothing to dial. Spam calls are unwanted calls and texts, from aggressive sales robocalls to outright scams, and phone number privacy is about limiting who can find your number and what they can do with it. This guide explains, in plain English, how call blocking on iPhone and Android works, what the Do Not Call Registry and the UK Telephone Preference Service (TPS) can and cannot do, what STIR/SHAKEN caller ID checks mean for you, and how to report spam with 7726. It is for anyone tired of scam calls, and for IT and security teams who advise staff. For the network operator's side of the problem, see the Scam Prevention in Telecoms Guide.

Key takeaways

• Turn on the filters you already have. iPhone offers Screen Unknown Callers and a spam filter under Settings > Apps > Phone, and the Phone by Google app has "See caller ID & spam" on by default plus an optional "Filter spam calls" toggle.
• Registries stop legitimate sellers, not criminals. The FTC says the US National Do Not Call Registry does not stop scammers, and Ofcom says the free UK TPS will not stop all unwanted calls and takes up to 28 days to work.
• Caller ID can lie. Scammers fake names and numbers, including "neighbour spoofing" that copies your area code; STIR/SHAKEN helps networks check caller ID but does not catch every spoofed call.
• Never press a number or call back. The FTC warns that pressing any key on a robocall can lead to more calls; hang up and contact the organisation on a number you already trust.
• Report to 7726. In both the US and the UK, forwarding a spam text to 7726 (SPAM on a keypad) alerts your mobile provider, and in the UK you can text a scam caller's number to 7726 as well.

What it is

A robocall is a call that plays a recorded message instead of a live person. The FTC explains that robocalls selling something are illegal in the US unless the seller has your written permission, given directly, and the company cannot make that permission a condition of buying. Spam texts are the same idea by SMS or messaging app. Caller ID spoofing is when the caller fakes the name or number on your screen, often to impersonate a bank, tax office or government agency.

Phone number privacy is the other half: your mobile number is now a login identifier, a password reset channel and a marketing key. The fewer places it appears, the fewer spam calls you get, and the harder it is for criminals to target your accounts.

Types of unwanted call and what works against them

How it works

Blocking on your phone

Two details catch people out. On iPhone, call screening turns off for 24 hours after you call emergency services, so a returning call from the ambulance service or police is not silenced. On Android, filtered calls still appear in call history and voicemail, but you get no missed call notification for them. Android's fake call detection, which warns when a caller hides their identity or impersonates a contact, needs Android 12 or later with the Phone by Google, Contacts and Google Messages apps and RCS switched on.

Blocking by your provider and apps

• Network services: the FTC suggests asking your provider which call-blocking or call-labelling services it offers; some are free, some charged. Ofcom notes UK providers can block types of call, such as international or withheld numbers, or a short list of numbers, and advises checking that a service will not block calls you want.
• Call-blocking apps: these use call data, user reports and FTC data to flag likely scam calls. Some read your contacts, so the FTC advises checking the privacy policy first.
• Landlines: call-blocking devices can use databases of known scam numbers, your own list, or a prompt that asks callers to press a number or say their name, which screens out many robocalls.

What STIR/SHAKEN means for you

STIR/SHAKEN is a set of standards that lets the phone company that starts a call digitally sign the caller ID, and lets the other networks check that signature as the call passes through. The FCC describes its purpose as fighting illegal caller ID spoofing, making caller ID more accurate and helping trace illegal robocalls. The signature carries an attestation level defined in RFC 8588:

In practice, some US carriers turn this into a "verified" mark or a "spam likely" label on screen. It is a check on the number, not on the person or their intentions, and it does not work across networks that are not IP based. Treat it as one signal among several.

Why it matters

• Calls are a front door for fraud: impersonation calls from a "bank fraud team" or "tax office" lead to authorised payments that are hard to recover. See the Vishing and Smishing Guide.
• Your number unlocks accounts: many services send password reset codes by SMS. A criminal who knows your number can try to move it to their SIM. See the SIM Swap Fraud Guide.
• Replying confirms you exist: Ofcom warns that replying to unknown senders can confirm your number is active and bring more messages and calls.
• Reports feed blocking: the FTC publishes the illegal callers' numbers it receives each business day so phone companies can improve call blocking and labelling, and Ofcom says 7726 reports alert your provider to investigate and potentially block the number.

Where to report

When reporting, the FTC asks for the number that received the call, the number on caller ID even if it may be fake, any call-back number you were given, and the date and time. Other countries' routes are in the Consumer Reporting Routes Map.

Common misconceptions

• "The registry will stop scam calls." The Do Not Call Registry and TPS only bind organisations that follow the law; registering still helps because remaining sales calls are more likely to be scams.
• "If caller ID shows my bank, it is my bank." Spoofed names and numbers are routine; hang up and call the number on the back of your card.
• "Pressing 9 to opt out will remove me." On illegal robocalls it can mark your number as live and lead to more calls.
• "Reply STOP to every text." Ofcom says reply STOP only to senders and short codes you recognise; for unknown senders, do not reply and forward to 7726 instead.
• "Blocking one number solves it." Spoofers rotate numbers constantly, which is why spam filters and screening work better than blocking individual numbers.
• "A verified mark means it is safe." STIR/SHAKEN checks that the number is not spoofed, not that the caller is honest.

Related concepts

• Number hygiene: keep your main number off public profiles, marketplace listings and competition entries; use a second number or app-based number for sellers and sign-ups; untick marketing consent boxes.
• Account recovery: where a service offers an authenticator app or passkey, use it instead of SMS codes, so your number matters less if it is hijacked.
• Data brokers: people-search sites often publish numbers. In California, see the California Delete Act and Data Broker Registration Guide.
• The law on marketing calls and texts: US rules on autodialled calls and texts are covered in the CAN-SPAM and TCPA Guide.
• Messaging apps: Ofcom advises using WhatsApp, Telegram or Signal's own block and report tools as well as your phone's built-in reporting.

For IT and security teams

• Brief staff: a call from "IT support" asking for a code or password is a known attack pattern. See the Vishing and Help Desk Social Engineering Awareness Guide.
• Company phones: enable spam filtering and unknown caller screening in your mobile device management baseline where your platform supports it.
• Measure: track staff reports of vishing and smishing, the share of managed phones with filtering on, and accounts still using SMS as their only second factor.

Practitioner checklist

• Turn on spam filtering and unknown caller screening on every phone you manage or own.
• Register landlines and mobiles with the Do Not Call Registry (US) or TPS (UK), and expect up to 28 days for TPS.
• Ask your mobile and landline provider which blocking or labelling services it offers.
• Hang up on robocalls without pressing keys, and call back organisations only on numbers you already trust.
• Forward spam texts to 7726, and report losses to ReportFraud.ftc.gov or Report Fraud and to your bank.
• Remove your number from public profiles and listings, and use a second number for sign-ups.
• Replace SMS codes with an authenticator app or passkey on important accounts, and set a carrier account PIN.
• Check privacy policies before installing third-party call-blocking apps that read your contacts.

Standards and references

• US Federal Trade Commission: How to Block Unwanted Calls
• US Federal Trade Commission: How to Recognize and Report Spam Text Messages
• US Federal Communications Commission: Combating Spoofed Robocalls with Caller ID Authentication
• IETF: RFC 8588 PASSporT Extension for SHAKEN
• Ofcom: How to protect yourself from nuisance calls and messages
• Ofcom: What to do about a scam call, text or message
• Apple: Manage unknown callers on iPhone
• Google: Use caller ID and spam protection

Related NHI Mgmt Group resources: Scam Prevention in Telecoms Guide · Vishing and Smishing Guide · Parcel Delivery and Toll Text Scams Guide · What to Do If You Have Been Scammed Guide