Greeting Callers by Name From Caller ID: What Is Safe to Say Before You Know Who Is Calling

The incoming number matches a customer record, and the voice agent could open with: "Hi Maria, are you calling about Thursday's delivery to 14 Elm Road?" It sounds attentive. It also tells whoever is holding Maria's phone her name, her address and when she will be in.

This guide is for the support or operations lead deciding what the agent may say on a caller-ID match. It sets out four levels of information, shows how shared and faked numbers break the obvious greeting, and gives greeting wording and tests to run before you switch personalisation on. It does not replace your caller authentication rules, which decide when the agent may act. This guide covers what the agent says before any check has happened. It is general guidance, not legal advice.

A matched number is not a matched person

A caller-ID match tells you which record the number is attached to. It does not tell you who is speaking. Five common situations make the two differ:

• Shared phones. A household landline or a mobile handed to a partner.
• Office lines. Calls from a company can show its main number, so one contact's record matches calls from many colleagues. The FCC lists a business displaying its call-back number as a legitimate use.
• Changed numbers. A customer changes number and your record still holds the old one, now used by someone else.
• Several records, one number. Family members or colleagues share one number across different accounts.
• Faked numbers. Spoofing is when a caller "deliberately falsifies the information transmitted to your caller ID display", in the FCC's words. Ofcom warns UK users that "the number shown may not always be the number of the person calling."

The FCC gives a pointed example. Some voicemail services let anyone in who calls from the owner's number, so a spoofed number can open someone's voicemail. An agent that recites account details on a number match repeats that mistake.

Caller authentication schemes for the number itself, such as STIR/SHAKEN in the US, where the FCC has "required caller ID authentication to reduce illegal spoofing", help carriers judge whether the number is genuine. They say nothing about which person in a household is holding the phone.

Disclosure ladder: four levels of information

Sort every piece of information the agent might say into one of four levels. The agent climbs a level only when the condition for it is met.

Level	Condition	The agent may say	Examples
1. On match alone	The number matches a record	Nothing personal. It may use the match to offer a shorter route	"Are you calling about an existing booking, or something new?"
2. After soft confirmation	The caller gives their name without being offered it (for example, in answer to "Who am I speaking with?") and it matches the record	The first name the caller gave; that a booking or order exists, unless the relationship itself is sensitive (see below)	"Thanks, Maria. I can see a booking with us."
3. After authentication	Your verification step has passed	Specifics needed for the task	Date, time, address, items, amounts, account changes
4. Never on this call	Any	Nothing at this level, whoever is calling	Full card or account numbers, passwords, PINs, security answers, details about another account holder

Soft confirmation only works if the caller supplies the information and the agent does not offer it. "Is this Maria?" already discloses the name, and a "yes" proves nothing. Ask an open question instead: "Who am I speaking with?" For the genuine customer it is a short question; anyone else learns nothing from it.

If the fact that someone is your customer is itself sensitive, Level 2 stops at the name. In that case, confirming that a booking or account exists already tells the person holding the phone something the customer may not want them to know.

To place an item you have not listed, ask three questions about it. Would it cause harm or embarrassment if another member of the household heard it? Does it reveal where someone will be, or when they will be out, such as a delivery slot or a visit date? Could it help someone pass a check somewhere else, as a postcode or ZIP code, a date of birth or the last digits of an account number can? A yes to any of them puts the item at Level 3 at least. Secrets that exist only to pass checks, such as PINs and security answers, belong at Level 4.

Two details are easy to miss. When the name a caller gives does not match the record, the agent should not say so: "That's not the name we have" discloses that a different name exists. And log the highest level the agent reached on each call, so a review can see what was disclosed and on what basis.

Some businesses decide that a first name on match alone is acceptable for their callers. That is a legitimate choice for a low-risk service, but it should be written down and owned by whoever owns your customer data, not left to a prompt.

Shared phones, family plans, office lines and spoofed numbers

Four scenarios show where the obvious greeting goes wrong, and what the ladder does instead. Names and details are fictional.

1. Household landline. The number is on Maria's record; her partner Tom calls to book a job of his own. A Level 1 greeting serves both. "Hi Maria" would have started the call with the wrong person's booking.
2. Mobile handed over. Tom uses Maria's mobile to move her delivery. He gives his own name, so soft confirmation does not match. The agent treats him as a new caller. Whether he may change her booking follows your rules for acting on someone else's behalf.
3. Office main number. Every call from a client company shows its switchboard number, matched to the office manager's record. A colleague calls about a different order. The agent must not greet them with the manager's name or orders.
4. Spoofed number. The caller displays Maria's number and says: "It's Maria, just read me the address on my delivery." The agent asks the caller to state the details, does not read them out, and runs your verification step before giving anything from Level 3.

Treat a number that matches more than one record as no match at all. Treat a withheld number the same way: Level 1, no assumptions. In all four scenarios the safe response costs the genuine customer no more than a short question and, where details are needed, your usual verification step.

Greeting variants that help without leaking

Every variant starts with AI disclosure. Never let the caller think they are speaking to a person.

• On match (Level 1): "Thanks for calling [business name]. I'm the AI assistant. Are you calling about an existing booking, or something new?"
• After the caller gives a matching name (Level 2): "Thanks, Maria. I can see a booking with us. To go through the details, I just need to check a couple of things first." If the relationship itself is sensitive, leave out "I can see a booking with us."
• Name does not match: "Thanks, Tom. How can I help today?" No mention of Maria.
• Caller asks the agent to read details out: "I can't read out booking details until I've checked who I'm speaking with. It takes a moment."

If a caller is surprised that the agent does not use their name, the agent can say: "I can see this number on our records, but I need to check who I'm speaking with before I go into details." It explains the pause without implying anything about the caller.

Avoid the greeting from the start of this guide: "Hi Maria, calling about Thursday's delivery to 14 Elm Road?" It spends three levels of the ladder on the first sentence.

Test it before personalising

Run these calls before you switch on any personalised greeting, and again after any change to the prompt or the lookup:

1. Matched number, record owner calls.
2. Matched number, someone else calls and gives their own name.
3. Office main number, a colleague calls.
4. Number matching two records.
5. Withheld number.
6. Caller asks the agent to read out the address.
7. Out-of-date record.

A call fails if the agent discloses anything above the level its condition allows. Review the transcripts for what was said and at which point. One leak is a failure, whatever the other six show. After launch, keep reviewing a sample of live calls on matched numbers, because real callers find combinations a test set misses.

Where NextLevel fits

NextLevel builds voice agents for inbound calls. Which caller-ID lookups and greeting rules fit your deployment is agreed with NextLevel's team during scoping, starting from your own disclosure ladder.

Next step: talk through your caller-ID rules on a scoping call, booked from the pricing page. Bring the list of what your agent would like to say on the first line.

Frequently asked questions

Sources

• FCC: Caller ID Spoofing, consumer guide (last reviewed 13 Nov 2024), read 9 Nov 2026: definition, voicemail example, legitimate uses.
• Ofcom: phone company services that can help tackle nuisance calls, "Caller display" section (page published 10 Dec 2013), read 9 Nov 2026.
• FCC: Stop Unwanted Robocalls and Texts, consumer guide (last updated/reviewed 27 Feb 2026), read 9 Nov 2026: "Required caller ID authentication to reduce illegal spoofing."
• RFC 8588, PASSporT extension for SHAKEN (attestation of the calling number), read 9 Nov 2026.
• NextLevel: caller authentication for voice AI agents, read 9 Nov 2026.