“Who is this?” (on the phone) or “Who’s that?” (at the door) may not be technically wrong, but can sound rude; might be used if you’re suspicious that the person might be someone undesirable. So, it sounds just a bit awkward to say “who is this/ that?” over the phone or at the door.
A native speaker’s normal reply would be “Who is it?” (on the phone or at the door). So, “who is it?” is standard and “who is this / that?” have a sense of confusion and disagreement.
Examples of “Who is this?”
Jane often gets pushy to some rude caller on the line – a person who says “Is that Ms Jane?” (to which Jane replies) and then the caller asks her to confirm her postcode, without introducing themselves. In these circumstances she feels she has a right to jettison politeness, so these people tend to get a “Who’s this?” from her. Here, this ‘this’ indicates a a negative reaction (which can also denote kind of suspicion and rejection).
Examples of “Who is it?”
Who is the person on the other side of a door or end of the telephone line?
“Yes? Who is it?” Jane called out in response to the knocking.
Sarah: “Someone on the phone for you, Jane.” Jane: “Who is it?”
Notice that “Who is it?” is used in a standard way, as a common answer when answering calls. But “Who is this?” uses the less definite ‘this’, which is often employed to refer to something unknown, or to indicate a sense of confusion. For example, if you are accompanying a friend to the market and they ran into one of their friends that you didn’t know you might ask “who’s this?” (though it might sound a little rude).
We also use ‘this’ when we introduce two people: “Jane, this is Emily.” When introducing ourselves on the phone, we say: “Hello, this is Jack. Can I speak to Mrs Wilson, please?”
