I may get down voted for this and so be it, this must be said.  This is a prime example of creating what was intended to be a security feature without understanding the threat landscape.  I just tested it, and it&#x27;s 100% vulnerable to caller ID spoofing.  In 2016, caller ID spoofing is as simple as downloading an iPhone app and spending $30 for a bunch of minutes.<p>The problem is, a lot of people will find this cool and will also not evaluate the threat landscape.  In fact, it&#x27;s even worse.  They will assume the threat landscape has already been evaluated.  The code is out there, so it must be good.  They will then implement this into some &quot;super duper secure&quot; service which should require a far more security for user authentication.  It will then take me 15 minutes of pulling my hair out in a security review to explain to whomever implemented it that it offers no security.  The team will walk away from our meeting wondering if I was just trolling them and ask how their entire team could have made this mistake.  They will then come to the conclusion they are smart and I must be wrong.  They&#x27;ll then call me back to explain again, at which point I&#x27;ll take them through a full video demonstration with their VP of operations on the call.  This time they will actually &quot;get it&quot; because they saw it exploited on video.  Their VP of operations will then fire the project manager and lead developer and I&#x27;ll feel like shit for being responsible for the termination of two careers.