Blog
Guides and insights on AI voice agents, call centers, and calling at scale.
Telephony & Dialing
STIR/SHAKEN and Caller ID Verification Explained
Published
For a long time, the name or number shown on caller ID could be faked with very little effort. Criminals used this to make calls appear to come from banks, government agencies, local numbers, or trusted businesses. This practice, known as spoofing, made scam calls far more convincing and left people unsure whether any caller ID could be trusted.
STIR/SHAKEN is the system introduced to tackle that problem. It's now a core part of how calls are handled in the United States and Canada, and it affects every business that makes calls there. This article explains what it is, how it works, and what it means in practice.
What Is Caller ID Spoofing?
Caller ID spoofing is when a caller deliberately changes the number displayed on the recipient's phone. On older phone networks, the calling number was largely passed along on trust. Internet-based calling made it even easier to set any number as the caller ID.
Spoofing isn't always malicious. A business might legitimately display its main number when calls are made from different lines. But it became a major tool for fraud, because people are far more likely to answer a call that appears local or familiar.
What Is STIR/SHAKEN?
STIR/SHAKEN is a framework that allows phone providers to digitally confirm that the caller ID on a call is genuine, and to show whether the calling party has the right to use that number.
The name combines two sets of standards:
STIR stands for Secure Telephone Identity Revisited. It's a set of technical standards developed by the Internet Engineering Task Force for digitally signing caller identity information in internet-based calls.
SHAKEN stands for Signature-based Handling of Asserted information using toKENs. It's a framework, developed by telecom industry bodies, that defines how phone providers should put STIR into practice across their networks.
In simple terms, STIR provides the technology, and SHAKEN provides the rules for how phone companies use it.
Why It Became Required
In the United States, the TRACED Act, signed into law in December 2019, required phone providers to implement STIR/SHAKEN. The Federal Communications Commission (FCC) set deadlines, requiring major providers to put it in place on their internet-based networks by June 30, 2021, with later deadlines for smaller providers. Canada introduced similar requirements around the same time through its regulator, the CRTC.
How STIR/SHAKEN Works
The process works much like a digital signature on a document. It happens automatically, in a fraction of a second, every time a call is placed.
1. The call is placed. A business or person makes a call through their phone provider.
2. The originating provider checks the caller. The provider that first handles the call looks at who its customer is and whether that customer is entitled to use the number shown as the caller ID.
3. The call is signed. The provider creates a digital token containing details about the call, including the calling number, the number being called, the time, and an attestation level showing how confident the provider is about the caller's right to use the number. The token is signed using a secure digital certificate issued to the provider through an approved certification system.
4. The call travels across networks. The signed token travels with the call as it passes between providers.
5. The receiving provider verifies the signature. The provider of the person being called checks the token against the originating provider's certificate. If the signature is valid and the details haven't been changed, the caller ID is confirmed as authentic.
6. The result informs how the call is handled. The verification result can be used, alongside other information, to decide whether to display a "verified" indicator, apply a spam label, or block the call.
The Three Attestation Levels
The attestation level is one of the most important parts of STIR/SHAKEN, because it shows how much the originating provider knows about the caller.
A — Full attestation
The provider knows the customer, and has confirmed that the customer is authorized to use the calling number. This is the highest level of trust, and it's what legitimate businesses should aim for.
B — Partial attestation
The provider knows the customer and where the call came from, but can't confirm that the customer is authorized to use the specific number shown. This can happen, for example, when a business uses a number obtained from a different provider.
C — Gateway attestation
The provider has received the call from somewhere else, such as an international network or another provider that didn't sign it, and can't verify who the caller is. The provider is simply recording where the call entered its network.
A call with A attestation isn't guaranteed to be wanted or legitimate, since STIR/SHAKEN only verifies identity, not intent. But calls with lower attestation are more likely to be treated with suspicion by spam-labeling systems.
What STIR/SHAKEN Doesn't Do
STIR/SHAKEN is powerful, but it has clear limits.
It doesn't judge the content of a call. It confirms who is calling, not whether the call is welcome, honest, or legal. A business with fully attested numbers can still make calls that people report as spam.
It doesn't block calls on its own. It provides information that carriers and analytics systems use when deciding how to handle calls.
It only works on internet-based networks. STIR/SHAKEN depends on calls travelling over IP (internet protocol) networks from start to finish. If a call passes through older, non-IP equipment along the way, the signature can be lost. The FCC has required providers with non-IP networks to work toward alternative solutions or to show they're taking other steps to fight robocalls.
It doesn't apply everywhere. Calls that start outside the United States or Canada often enter the network with C attestation, because the foreign network didn't sign them.
The Robocall Mitigation Database
Alongside STIR/SHAKEN, the FCC created the Robocall Mitigation Database. Phone providers must file information about their STIR/SHAKEN status and the steps they take to prevent illegal robocalls. Providers are generally prohibited from accepting call traffic from providers that aren't listed. Providers can be removed from the database for failing to meet their obligations, which effectively cuts them off from US networks.
This creates accountability throughout the chain. Every provider that carries a call has a responsibility to know where its traffic is coming from.
STIR/SHAKEN Outside North America
The United States and Canada were the first to require STIR/SHAKEN, but other countries are introducing their own caller ID authentication systems, sometimes based on the same standards and sometimes on different approaches. France, for example, has introduced its own number authentication requirements for calls. In the United Kingdom, Ofcom has signaled its intention to introduce caller ID authentication once the country's move from the old phone network to internet-based calling is complete. In the meantime, many regulators use other measures, such as blocking calls from numbers that are invalid or shouldn't be making calls.
What STIR/SHAKEN Means for Businesses That Make Calls
For businesses calling into the United States or Canada, STIR/SHAKEN has practical consequences.
Attestation affects how calls are treated
Calls with full A attestation are generally treated more favorably by spam-labeling and call-blocking systems than calls with B or C attestation. Poorly attested calls are more likely to be labeled as spam or blocked, which reduces the number of people who answer.
Number ownership matters
The best way to achieve A attestation is to place calls through a provider that knows the business and has confirmed its right to use the numbers. Using numbers that belong to another provider, or numbers the business hasn't properly registered with its provider, can result in lower attestation.
Where calls originate matters
Calls placed from outside North America, or through providers that don't sign calls properly, may reach US networks with C attestation. Businesses calling the US from other countries should understand how their calls are routed and signed.
Choose providers carefully
Reputable providers sign calls correctly, are listed in the Robocall Mitigation Database, and can explain what attestation level a business's calls will receive. Providers that can't answer these questions clearly may cause problems.
It works alongside other good practices
STIR/SHAKEN is only one part of a number's reputation. Calling people who expect to hear from you, respecting Do Not Call lists and opt-outs, keeping call volumes reasonable, and registering numbers with analytics providers all still matter.
Toward Calls People Can Trust Again
STIR/SHAKEN won't end unwanted calls on its own, and it was never meant to. What it does is restore a basic level of trust to caller ID: when a call is fully verified, the number shown is genuine and belongs to the person or business calling. For people answering the phone, that's a meaningful step toward knowing who's really on the line. For businesses, it's a reason to make sure their calls are properly authenticated, so that legitimate calls can be recognized as exactly that.