I remember how shocked I was when I first learned how insecure caller-ID is. I was setting up a VOIP PBX for the small business I was taking over from my father

I remember how shocked I was when I first learned how insecure caller-ID is. I was setting up a VOIP PBX for the small business I was taking over from my father after he passed away unexpectedly. I hadn't been able to get into his (telco-hosted) voicemail, until I happened to call the number from the new VOIP line. Since I had the caller-ID set to the same number, the voicemail system not only bypassed the greeting, but it automatically logged me in (it was set to bypass the PIN when calling from the same line). I tell people that caller-ID should be trusted as much as the return address on an envelope. Perhaps I can soon update my guidance now that STIR/SHAKEN is (apparently) near full rollout.