There's two means of number identification -- caller id (CID), and automatic number identification (ANI). ANI used to be a lot harder to spoof than CID; likely because ANI is always delivered out of band, and some early CID spoofing was done by just overplaying in-band CID. On the consumer side of things, you're allowed to disable CID on outgoing calls, but not to disable ANI.

Toll free routing may be less amenable to grey routes and things as well. International callers aren't "supposed" to be able to call US toll free numbers, which may make it harder to get to. I've seen some companies claim that they can use call routing information to toll free numbers to get accurate caller id information in some countries; but I would never trust it.

You also shouldn't trust the source IP, or the return address on a standard envelope in the mail, unless you have convincing evidence. It's hard to think of an example of a source address in communications that's really trustable.

Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw.

As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.

Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D

If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.

Best to extract as much iinfo as possible, business name, callback numbers, email addresses, etc. The more info, the easier it is for the FCC to bring enforcement action against fraudulent callers.

haha, "four-flag key" is still an inside joke with my family because of how many times we got a scammer to say it while they "provided tech support" to us :)