Key points
In summary
Public sources may establish where a number appeared, when and alongside which claim. A possible link is different from a verified identity. The displayed number may be spoofed, and an old advert may be out of date. The agreed analysis provides sources, findings, discrepancies and limitations. Start with a general description, without sending the number or case materials.
A public reference, a possible link and a verified identity
The starting point is a known number and a defined question. Analysis can examine available adverts, organisation websites and other public material, then compare dates, offer descriptions and contact details.
- A public reference: a page published the number as a contact in a particular context. This is a finding about the source's content.
- A possible link: matching details may connect publications. Their origin and recency need checking, including whether they repeat the same listing.
- A verified identity: this requires a basis beyond the number appearing in a source. A name in an advert does not settle who uses the number or conducts a conversation.
A comment posted online may suggest something to examine, but it is not proof of fraud on its own. Several copies of one advert do not provide several independent confirmations either.
The displayed number may not identify the caller
Caller ID spoofing makes a call appear to come from another number. CERT Polska explains this mechanism (in Polish) in its warning about fake bank employees. A match between the number on your screen and an institution's real number does not establish that its employee is calling.
If the conversation seems suspicious, end it and contact the institution using a number independently found on its official website. Calling back from your call history does not establish who made the earlier call.
Time creates a separate uncertainty. An old advert can remain online after an offer has expired or contact details have changed. The date a page is accessed is not the date its number was confirmed as current. Analysis should identify the period a publication concerns and what remains unknown about the present position.
Example: a number in an old advert
Synthetic example — no real person or matter is described. Number A appears in an archived advert for Service B. The same number has now appeared on the screen during a suspicious call.
The source supports a finding that the advert used Number A in connection with Service B at that time. It does not, by itself, establish the current user or the person responsible for the call. An outdated listing or a spoofed number are possible explanations. The connection between the advert and the call remains a question to assess.
Phone-number analysis and mobile device forensics
OSINT analysis examines information outside the device, such as public references to a number. Mobile device forensics is a different kind of work, involving the preservation, acquisition and examination of data from a phone. The NIST guide to mobile device forensics describes that field.
A phone-number analysis assignment does not include reading the phone's contents, recovering messages or examining the device. It does not provide access to telecom subscriber records, SIM registration details, private accounts or live location. We do not promise to identify the owner of every number.
When analysis may help and what you receive
Consider analysis when you need to compare a number with a particular offer, clarify conflicting contact details or organise public traces after a suspected scam. “Does this number appear in material connected to this offer?” defines a clearer scope than “find everything about its owner”.
The agreed written output provides sources and dates, findings, the basis for possible links, discrepancies and unresolved points. It may conclude that the available sources cannot answer the question. This helps you assess a particular contact; it does not guarantee recovery of money or identification of an offender.
See our known-number analysis service for the scope. If an incident has already occurred, the guide to preparing materials after a suspected scam may also help. Analysis is not a substitute for urgent contact with your bank or the appropriate authorities.
What to include at first contact and what affects the fee
Describe the type of contact, approximate period, reason for concern and the question you need answered. Explain the connection to Poland. It is enough to say that you hold a number, an advert or a call record; do not initially send their contents, personal details or documents.
The fee depends on the number of phone numbers and lines of enquiry, the period, source availability, any need to compare older publications, and the form of the output. We assess feasibility first, agree the scope and fee, and enter into a contract. You then share the necessary materials through an individually agreed channel. Tell us in general terms what you want to check.
Sources
Sources checked on 26 September 2026. The example is synthetic; the description of the service follows OSINT Detektyw's offer.
- CERT Polska — Fake bank employee scam (in Polish): caller ID spoofing and independently checking a contact number.
- NIST SP 800-101 Rev. 1 — Guidelines on Mobile Device Forensics (2014): the separate field of device examination; not a description of OSINT Detektyw's services.