Call log glossary: telling a spoofed call from a real one

"Is this me or not?" That was the subject line on a screenshot a reader sent last month. It showed one number four times in her Recents list, two of them missed, with the first six digits matching her own. She was sure she had never dialed it, and she was right, though the log said so in a column she was not looking at. Reading a call log is mostly a matter of knowing what each word on the screen refers to, so this page is a glossary. Terms are grouped by where you meet them, and an entry links to a longer page when one exists.

On your phone

Call log (Recents)

The phone's own list of calls that touched your handset. Each entry has a number or contact name, a time, a direction and, in the detail view, a duration. It does not record the route a call took, who paid for it or whether the number on screen was honest. Think of it as the phone's diary, written from the phone's point of view. On an iPhone, open Phone > Recents and tap the small info button on a row. In Google's Phone app, open Recents and tap a row to see its history. Samsung and other makers customize this screen, so icons may differ from what I describe.

Direction

Incoming, outgoing or missed. It is the first thing to check, because it separates the two spoofing situations people mix up: a call arriving with a false label, and your own label being used on calls elsewhere. Missed calls show in red on both iPhone and Google's Phone app, and outgoing ones carry an arrow pointing away.

Incoming call from your own number

The network logged the label the caller supplied, and the label happens to be yours. It looks absurd and is harmless on its own. See calls from your own number for the decision flow.

Outgoing call you do not remember

The entry that worries me. It can be a pocket dial, a voice assistant, someone using your phone or a compromised account. Check it against your carrier's record the same day.

Duration

The quiet clue. A call lasting twelve seconds before you said anything fits a recording that waited for you to speak, and fits a machine better than a person who wanted to reach you.

Zero-second call

A call that rang once and dropped. It is typical of automated dialing, where the system hangs up the moment it decides nobody useful answered. See silent calls and hang-ups.

Prefix

The first six digits of a ten-digit number, meaning the area code plus the exchange. A matching prefix is weak evidence, since plenty of honest local callers share your first six digits by plain chance, especially in small towns. The disguise built on it is covered in neighbor spoofing.

Burst

Several calls from different numbers within a few minutes, or the same prefix at nine in the evening. It points toward a dialer working through a list. Scroll back a week and count how many unknown entries share a prefix.

At your carrier

Carrier usage record

The second list, and the one that wins any disagreement. Your carrier's usage or call detail page lists calls your line placed and received, billed or not, as the network saw them. Sign in to the carrier's app or website and look in the usage, call detail or recent activity section, whichever your carrier calls it. A spoofed incoming call often appears there as a received call from the number it claimed, because the network saw it arrive at your line. What would worry me is an outgoing line at a time you cannot account for.

Retention window

How far back the record goes. Some carriers show only the last few weeks online and hide detail for unanswered calls. Support can often look further back than the app, though I would not promise it for every carrier, so ask what they can see.

Account PIN

A code the carrier asks for before changing anything on the account. Together with a strong, unique password it is the cheapest protection against takeover. Names vary by carrier, and port-out protection is the related feature.

SIM swap and port-out request

Two ways someone can try to take over a line. A carrier message about one you did not ask for deserves same-day attention.

Patterns and what they suggest

Spoofed call

A call whose displayed number was chosen by the caller. It shows in your log as an ordinary entry. If people say you called them and there is no matching outgoing line, your number was borrowed, and what to do if someone uses your number picks up from there.

Automated dialer

Software that places many calls at once and passes answered ones to a human or a recording. It explains most zero-second calls, silent calls and empty voicemails.

Calling app, or VoIP line

A service that places calls over the internet and may write to the same Recents list. If an entry appears in your phone log but not in your carrier record, look for a second phone or an app like this before assuming anything stranger.

Verified label

A checkmark the carrier may add after a signed check on the number. It does not appear in the log and says nothing about honesty. See what the checkmark means.

Block list

The numbers your phone refuses. Handy for a known caller, and weak against numbers that rotate, as why blocking fails explains.

Strong clues, weak clues, and what to save

Strong clue

An outgoing entry you cannot explain. Act the same day: call your carrier from another phone, set or change the account PIN, change the password. Two other same-day triggers are a carrier message about a SIM change or port-out you did not request, and any sign that someone reached your account.

Weak clue

A matching prefix, or one polished voicemail. A caller that leaves a name and a callback reason is on balance less likely to be a scam than one that leaves nothing, but a polished message proves nothing either. Repeated calls from the same number at the same hour count for a little more, as modest evidence of automated dialing.

Evidence file

What to build before you clear the list. Screenshot the entries and the detail view of the worst ones, write the date next to each, and keep it in a notes app and not as a growing album of screenshots you will never open. A short list of numbers and times is more useful than "they keep calling me" when you file at ReportFraud.ftc.gov or talk to your carrier. Both Apple Support and Google Support document how call history works on their own phones.

If you only want to know what an unfamiliar area code is assigned to, the number check will read it. It cannot say whether a call was spoofed, because a spoofed call can show a perfectly ordinary number.