Spam Calls: What Works, What Does Not, and Why They Get Through

It rings at 10:47 in the morning, the number carries your own area code, and after you pick up there are two clicks before somebody starts a question nobody wanted asked. Spam calls are the kind of nuisance you cannot avoid by living more carefully. They take no preparation, they cost a fraction of a cent per attempt, and that arithmetic is why they sweep through entire area codes in waves.

This piece works on three levels. First the practical part: blocking, filtering, silencing, so that tonight is quieter. Then the scripts, because a call is easier to end once you know where it is heading. And finally the question that actually nags at you by the third interruption of the morning: why does any of this reach your handset at all, when the problem has been technically solvable for years. The answer runs through Washington and Brussels, and it is less flattering to Europe than you might expect.

How to block spam calls right now

Start with what can be done in five minutes. None of these settings solves the problem. Together they cut the number of interruptions noticeably.

Blocking a single number

On iPhone, open the Phone app, tap the small i beside the entry in your recents, scroll to the bottom and choose Block this Caller. The list lives under Settings, Apps, Phone, Blocked Contacts. The caller hears nothing unusual on the next attempt while your phone stays silent.

On Android, press and hold the entry in the call log, or use the three dots in the call detail view, then Block number. The list sits under Settings, Blocked numbers. Samsung labels the same action slightly differently, the effect is identical.

On a landline, the router or the phone base does the work. Most modern gateways let you refuse a specific incoming number or a whole range, and the range option is the useful one, since blocking a single number rarely stops whoever is behind it.

Category filters beat individual blocks

Against automated campaigns, blocking one number at a time is close to pointless: the displayed number rotates, often several times an hour. Filters that work by category do more.

Silencing unknown callers is the single strongest measure and the one with the highest cost. The contractor, the pharmacy, the delivery driver and the callback from an office you phoned yesterday all land silently in voicemail. If you are waiting on returned calls, you will hate it. Everyone else notices mainly that the phone has gone quiet.

There is also the national do-not-call list, which in the United States means the FTC registry. It works exactly as far as its enforcement reaches: legitimate telemarketers respect it, and the operations behind the calls you actually mind never intended to comply. Registering costs nothing and takes a minute, so it is worth doing, provided you do not expect it to fix anything.

The same caveat applies to the third-party filter apps that dominate the app stores. They work from crowd-sourced blocklists synced through the cloud, which handles familiar call-center numbers well and fresh campaigns poorly, because the number calling you may have existed for ten minutes. The cost runs in the other direction: to tell you who is calling, the app has to learn something about your calls, and some request your entire address book while they are at it. We are not recommending or naming any of them. The question of what the vendor does with that stream belongs before the installation, not after.

Learning the scripts

The second part matters more than any setting, because sooner or later one gets through. Almost all of them follow a handful of patterns.

The one-ring call, known in the trade as Wangiri, is the cheapest of them. Your phone rings once, sometimes twice, then stops. What remains is a missed call from a country code you cannot place. The callback is the product: it routes to an expensive international destination, gets held there with a recording or a queue, and is billed by the minute, with a share flowing back to whoever controls the number block. Unfamiliar country code, look it up, do not dial it.

The panic call works on time rather than curiosity. A voice reports an accident, an arrest, bail money. The conversation never pauses, questions get talked over, hanging up is discouraged. The request not to tell anyone is the core of the method, because one short conversation with a second person ends the scheme almost every time.

The government impersonation call covers the fake police officer, the supposed Social Security or IRS agent, the Europol investigation. It often opens with an automated recording, sometimes in another language, asking you to press a key so a human can take over. Two things give it away regardless of the agency named: government offices put serious matters in writing, and no legitimate one asks for payment in gift cards, cryptocurrency or cash handed to a courier.

The tech support call announces that your computer has been sending error reports. The goal is remote access software, after which the caller shows you something alarming on your own screen and sells a cleanup. No operating system vendor calls its users unprompted. The same applies in reverse to the browser warning that displays a phone number for you to call.

What ties these together is the number on the display, which is forged in almost every case. How that works technically, and why your handset cannot detect it, we covered in detail in the piece on spoofing. For daily use, one sentence from it is enough: the displayed number is a claim made by the caller.

Reporting, and what regulators actually do

Reports work slowly, and they are the only lever that takes numbers out of service.

In the United States, complaints go to the FTC, which runs the national registry and the fraud reporting system, and to the FCC, which handles telecommunications enforcement and unwanted calls. In the United Kingdom, Ofcom takes number misuse and Action Fraud takes the financial side. In Germany, the Bundesnetzagentur covers both unlawful telephone marketing and number misuse through an online form. In every case the useful details are the same: date, time, the number that appeared, and a couple of sentences on what was said.

A single complaint changes nothing. Volume does. Regulators can order numbers taken out of service, prohibit billing and collection for them, and issue fines, and in the United States the FCC has repeatedly ordered carriers to stop accepting traffic from providers that kept letting fraudulent calls into the network.

Germany offers a good example of the European style of intervention, and it is worth knowing because it explains something you may have noticed. Since 1 December 2022, under a rule in the German Telecommunications Act, carriers must suppress the number when a call arrives from abroad carrying a German number as its origin. A German mobile customer calling while abroad still shows their genuine number, since the rule targets only abusively forged senders, not legitimate use from abroad. Calls are dropped outright, never put through at all, only for forbidden senders: faked emergency numbers such as 110 or 112, and premium-rate numbers used as sender IDs. The regulator announced the side effect itself: more calls now show up as unknown, because once the forgery is stripped, there is frequently no genuine number left to display. Protection made the phone more anonymous rather than quieter. How that withholding works from the caller’s side, and what it does not hide, is the subject of our piece on calling anonymously.

If money moved or credentials were handed over, the police and your bank belong in the loop immediately, since transfers can occasionally still be halted within the first hours.

Why the calls get through at all

Now the part that answers the nagging question. This problem is technically solvable. Two large economies have taken it on, and they chose opposite routes.

America signs the call

In the United States the answer is called STIR/SHAKEN. Behind the awkward acronym sits a simple idea: when a call enters a network, the originating carrier signs the calling number cryptographically and attests how confident it is that the caller is entitled to use it. The terminating network verifies that signature. If it is missing or does not check out, the call can be labelled or dropped.

The legal basis is the TRACED Act, passed by Congress at the end of 2019. From it came a hard deadline set by the FCC: large carriers had to have STIR/SHAKEN running in the IP portions of their networks by 30 June 2021. That is the reason a growing share of American calls now carry verifiable origin information, which feeds the carrier and analytics services that label a call as suspected spam before you have touched it, with the signature serving as one ingredient rather than the label itself.

None of which should be oversold. The scheme only works on IP-based connections, so wherever legacy switching sits in the path, the signature is lost. The FCC is still working on that hole, with a dedicated proceeding in April 2025 under the title Closing the Non-IP Caller ID Authentication Gap. And anyone who lives in the United States can confirm the obvious: robocalls did not disappear in 2021.

Europe sifts

Germany and the EU took the other road. It consists of recognising suspicious calls and removing them, without ever requiring a caller to prove the number belongs to them. The German rule from December 2022 is exactly that: a regulation that suppresses the German sender number on foreign calls and terminates faked emergency numbers, one well-defined, easily recognisable class of forgery. Effective against the blatant version, blind to anything that behaves more discreetly.

At European level the picture is thinner than you would assume. There is a common legal framework for telecommunications, the European Electronic Communications Code, formally Directive (EU) 2018/1972. Its own rollout shows how slowly these things move: the transposition deadline expired in December 2020, three member states met it, and only in August 2024 was it in force in all 27. BEREC, the body of European regulators, coordinates work on digital fraud, and a technical report on caller ID spoofing from CEPT/ECC has existed since 2022. Europol has published a position paper on it as well.

What is missing from that list is the decisive ingredient: a binding, EU-wide obligation to verify the caller cryptographically. There is no European counterpart to STIR/SHAKEN. There are national rules that differ from country to country, and there are individual movers. France introduced STIR/SHAKEN for domestic fixed-line numbers in October 2024. That it works there at all is because the French fixed network has long run over internet telephony, ever since Orange dismantled the old switched line network, which is precisely why the scheme can be applied to the landline in the first place. Since then the regulator Arcep has extended it to mobile numbers, and with a new numbering plan in force from early 2026 a large share of traffic is authenticated. It demonstrates that the route is perfectly walkable in Europe when one country decides to walk it.

The difference in one sentence

Europe sifts, America issues an identity document. Both carry a price. A sieve built on rules lets through everything the rule does not describe and spends its life chasing the next variation. An identity system demands effort from every participant, creates an infrastructure of certificates and trusted authorities, and works only as far as participation reaches, which is why calls crossing in from outside the system remain the soft spot in the American model too.

So the charge against Europe is not that nothing happened. Germany acted, in December 2022, and it had an effect. The charge is that 27 countries sharing a single market, a currency and a common telecom framework have still not agreed on a common answer to a question that looks identical at every one of their borders. In January 2026 the European Commission put a draft regulation on the table, the Digital Networks Act, which for the first time proposes harmonised measures against caller ID spoofing. The proposal is on the table, then, but it is not law in force, and it prescribes no particular cryptographic technique. As long as verification stops at a border, that is precisely where the door stays open.

What you can realistically expect

No tool and no setting fixes this, and whoever promises otherwise is selling a subscription. What is achievable is a substantial reduction plus a routine that costs you nothing when one does get through.

Three habits carry the day. Unknown numbers go to voicemail, and anyone with real business leaves a message or tries again. Calls that stand out get reported, because each report is a data point in a pattern a regulator can act on. And whenever money, credentials or urgency enter the conversation, you hang up and dial yourself, using a number from a source nobody read out to you. That last habit is the only one that still holds when the forgery is technically flawless. We described it at length in the piece on spoofing, and it remains the most reliable answer to a display you cannot trust.

Until Europe agrees on something binding and the United States finishes closing its non-IP gap, this is the state of play: filters that catch a portion, regulators that switch off individual numbers, and a telephone network that still takes its callers at their word.

Frequently asked questions

Where did they get my phone number?

Rarely from one place. Numbers circulate through sweepstakes entries, signup forms, data brokers, breached customer databases, and plain sequential dialling, where software simply works its way through an area code one number at a time. That last method is why unlisted lines get hit too, and why being careful with your number helps far less than people hope once it is in circulation.

Can spam calls be stopped completely?

No. You can block individual numbers, silence unknown callers and file reports, but the other side rotates its displayed number by the minute and dials from networks outside your regulator reach. What is realistically achievable is a sharp drop in how many actually reach you and interrupt something. Anyone promising to eliminate them entirely is selling a subscription.

What is a one-ring call?

A call that hangs up after a second or two and leaves a missed call from an unfamiliar international number. Calling back connects you to an expensive foreign destination that keeps you on hold as long as possible while the minutes are billed, with part of the revenue flowing back to whoever controls that number range. The industry term is Wangiri, Japanese for one ring and cut.

Is it illegal to call the number back?

Calling back is not an offence on your part. It can be expensive, though, because return calls to unusual country codes are billed at premium per-minute rates far above your normal plan. If an unknown international number rang only briefly, the callback is precisely the outcome the whole scheme is built on. Look the country code up afterwards instead of dialling it.

Should I answer and hang up, or not answer at all?

For a number you do not recognise, not answering is the quieter option, since a picked-up call confirms that a human sits behind that line. If you do answer, say hello and wait. Silence, or a click followed by a recording, is your cue to hang up. Avoid replying with a clear yes to questions like can you hear me, and never press a key to be removed from a list.

Does blocking the number help?

Against one persistent caller, yes. Against automated campaigns, only a little, because the number you block was probably borrowed for that campaign and will be replaced tomorrow. Category filters do more work: silence unknown callers on the handset, reject withheld numbers, and report the numbers that stand out so the regulator can act on the pattern.

What does reporting a spam call actually achieve?

Nothing immediate for you, quite a lot statistically. Regulators identify abuse by volume, and enough complaints against one number range trigger real consequences: numbers taken out of service, billing and collection prohibited, fines issued. In the United States that means the FTC and the FCC, in the United Kingdom Ofcom, in Germany the Bundesnetzagentur. Date, time, displayed number, two sentences of context.

Why do spam calls still get through despite the rules?

Because the two big approaches each leave a gap. American carriers have had to sign calls cryptographically since 2021 under STIR/SHAKEN, but the scheme only works across IP networks and the remaining gap was still open in 2025. Europe went the other way and filters obvious forgeries by rule, without any EU-wide obligation to verify who is calling. Neither closes the door completely.