Caller ID can't be trusted: it's easy for scammers to spoof legitimate phone numbers using software shared by criminals freely online.