Caller ID spoofing lets a scammer display any number they like: including one that looks exactly like yours, or your bank's, or your own company's switchboard. It's cheap, easy, and doesn't require any access to your actual phone at all.
The confusion this causes is part of the point: a spoofed call makes the recipient trust the number enough to lower their guard, and it can leave the real owner of that number fielding confused callbacks from people who never actually spoke to them.
The defence is the same regardless of what the screen says: a phone number alone was never proof of identity. If a call asks for anything sensitive, money, credentials, personal details, verify through a channel you already trust, not the one the call arrived on.
See how goDeep turns thinking like this into training your team will actually remember.