in the UK CLIP is done on an honour and best-effort basis
I would guess that is the case for most other places, all that is required is a poor implemention or unscrupulous person to abuse the CLIP part of an exchange system. Downstream exchanges have little choice but to assume the calling number is correct - must make a mess of the telco's billing systems.
I got a feeling we are at the thin edge of the wedge with this sort of hack and will probably see more of it.