Is a call from a local number a scam?

Hang up when the number copies your area code and prefix.

Neighbor spoofing is built to beat your first instinct. The caller makes the screen show a number like (415) 726-9034 because your own number starts (415) 726, while the call is being launched from a dialer that can forge the display. The matching prefix is the hook, not a clue that the caller is nearby.

Do not let a neighborhood name make the call feel safer.

Spoofed calls can display a real local number, and that number can belong to a dentist office, a neighbor, or a closed business that has nothing to do with the call. If the message is a recording about a bank transfer, delivery fee, warrant, or refund, the local name is decoration on a forged caller ID field.

Press no key when a robot says your money is moving.

The press-1 step separates frightened people from everyone else. Once you press, the robocall system marks your line as answered, active, and willing to follow prompts, then hands you to a live caller who continues the same fake emergency. The fake emergency is usually specific enough to scare you, like a $1,480 transfer or a 24-hour account lock.

Stay silent when the recording asks you to say yes.

Some local-number robocalls start with “Can you hear me?” or “Is this the account holder?” because a spoken answer proves a human is on the line. It also keeps you engaged long enough for the next prompt. A real security check does not need a surprise call from a copied local prefix to collect your voice response.

End the call if the agent asks for the code that just hit your phone.

In this script, the code is not for cancellation. The caller is trying to sign in, reset a password, add a device, or approve a transfer while you are still on the phone, then calls the code a reversal code or hold-release code. Reading it aloud gives the caller the exact number the real account system just sent to you.

Give no full name, address, or birth date to a caller who already dialed you.

Neighbor-spoofing callers often have only a live phone number, a city, and maybe a first name from a lead list. They ask for the rest under the cover of “verification,” then use those answers to pass future account checks or build a cleaner target record. The caller chose you first, so they do not get to make you prove who you are.

Hang up if they tell you not to hang up.

“Do not disconnect” is not procedure. It is a way to keep you from opening your banking app, calling the real institution, or asking someone nearby to look at the message. The local caller ID creates trust, and the no-hang-up order protects the lie while the caller tries to get a code, login, or payment.

Let unknown local calls go to voicemail even when there is no spam warning.

Scam Likely and Spam Risk labels come from carrier analytics and caller-ID authentication checks, including STIR/SHAKEN. Those checks do not make every bad call wear a warning label, and some spoofed calls still arrive looking ordinary. Voicemail strips away the pressure and leaves the caller with only the claim, which is easier to check.

Hang up before you press anything.

Do not press 1 to dispute the charge, 2 to speak to security, or 9 to be removed. Those keys tell the dialer your number reaches a person who reacts, and that makes the number more useful for the next local-looking call.

Write down the time, the displayed number, and the exact claim.

Save the voicemail if there is one. You are preserving the parts that matter for reporting and for checking your own records: the copied prefix, the amount named, the company or agency claimed, and whether the call asked for a code or payment.

Do not return the local number that called you.

Caller ID is the forged part of the event. A callback can reach an uninvolved local person whose number was spoofed, or it can route you back into the same scam setup. Treat the displayed number as contaminated evidence, not a contact path.

Open the account or app yourself and look for the exact event.

If the caller named a $1,480 transfer, a locked account, or a new device, look for that exact item after signing in normally. If nothing matches, the call was bait. If something does match, use the account’s own fraud or support option from inside the signed-in service.

Reset the named account if you gave a password, username, or code.

Start with the account the caller claimed to protect, because that is where the live caller was probably trying to sign in. Change the password, remove unknown devices or sessions, and review recent payees, contact details, and recovery settings.

Call your financial institution immediately if money or card data was exposed.

Use the number printed on your card or the number shown after you sign in, not the caller ID number. Ask for the fraud department, say you responded to a spoofed local-number robocall, and have them review transfers, card activity, new payees, and recent logins.

Report the robocall at ReportFraud.ftc.gov.

Include the displayed local number, the time, the amount in the script, the key you were told to press, and any payment or code request. That gives investigators the pattern, not just one disposable phone number. After reporting, block the displayed number, knowing the next attempt can use a different local number.