What the rules actually say

The operative instrument is ICASA’s Numbering Plan Regulations, not general electronic communications law. Regulation 12(1)(d) requires licensees to prohibit the transmission of an inaccurate Calling Line Identification as the originator of a communication. Regulation 12(2) goes further: numbers reported and found to have been used in the manipulation of CLI must be barred.

Regulation 9(1) gives the Authority a broader lever again, allowing it to stop a licensee routing communications to or from numbers it has determined were used in ways that could harm consumers or other licensees. Numbers, in other words, can be taken away.

This is not theoretical. In June 2026 ICASA approved sanctions against a licensed operator totalling R6 million, R3 million for each of two regulations breached, for using invalid numbers and numbers not allocated to it and for failing to use its allocation efficiently. The conduct cited included caller ID spoofing, call refiling and SIM boxing. The sanctions also barred the affected numbering resources and required monthly compliance reports for two years.

Separately, in April 2025 ISPA asked ICASA to act against call centres operating from fixed premises while presenting mobile numbers as CLI, because calls from mobile numbers get answered more often. The industry position is that this is unlawful use of mobile ranges rather than a clever tactic.

What legitimate masking is used for

Company identity on personal devices

Staff using a mobile app under a BYOD arrangement present the company number. The customer gets a number that reaches the business after hours, and the employee’s personal number stays private. This is the most common use by a wide margin.

Department rather than person

A support agent’s outbound calls present the support queue number, so the return call lands in the queue rather than on the desk of whoever happened to make the first call and is now on leave.

Campaign attribution

Different direct numbers presented for different campaigns, so return calls can be attributed. Useful, and it depends on holding enough numbers to allocate.

Two-sided masking

Delivery and ride-hailing platforms connect two parties through a system number so neither sees the other’s real number. Both legs terminate on numbers the platform holds, which is what keeps it inside the rules.

How it is set, and where it goes wrong

On any competent Cloud PBX the presented number is set at three levels: per user, per department or queue, and per outbound route. The more specific setting wins, which is why a user-level override is the usual explanation for one person’s calls presenting the wrong number while everyone else is fine.

Two things routinely catch businesses out. The first is verification: a reputable provider will only let you present a number it can confirm you hold, either because it issued it or because you ported it. If a provider lets you type any number into that field without checking, that is a warning about the provider, not a feature.

The second is emergency calls. Presentation settings should never apply to emergency numbers, where the originating identity is what matters. Confirm that your platform overrides masking on those calls rather than assuming it does.