STIR/SHAKEN explained: caller ID authentication
What STIR/SHAKEN is, how attestation levels work, why calls get labeled Spam Likely, and what businesses need to do to stay compliant.
What is STIR/SHAKEN?
STIR/SHAKEN is a caller ID authentication framework mandated by the FCC that authenticates caller ID information as calls travel across carrier networks. The two acronyms refer to different layers of the same system:
- STIR — Secure Telephone Identity Revisited — is the technical standard that defines how digital signatures are created and attached to calls.
- SHAKEN — Signature-based Handling of Asserted information using toKENs — is the deployment framework that specifies how US carriers implement and exchange those signatures in practice.
Together, they allow the originating carrier (the one placing the call) to cryptographically sign the call's identity, and the terminating carrier (the one delivering the call) to verify that signature. This tells the receiving carrier whether the number shown in caller ID was legitimately assigned to the caller placing the call.
Why STIR/SHAKEN was introduced
The framework was developed in response to the robocall epidemic — billions of calls per year placed using spoofed caller ID, impersonating government agencies, banks, and legitimate businesses to defraud consumers.
Before STIR/SHAKEN, there was no technical mechanism for a receiving carrier to verify whether the number shown in caller ID was the actual number the call originated from. Anyone with access to a VoIP origination service could present any number they chose. STIR/SHAKEN makes it possible — for the first time — to verify at the network level whether the calling number is legitimate.
Carriers use STIR/SHAKEN data alongside call behaviour analytics to decide whether to label a call "Spam Likely" or allow it through without a warning. The framework does not block calls; it provides a trust signal that analytics platforms use as one input in their labeling decisions.
Attestation levels: A, B, and C
When an originating carrier signs a call under STIR/SHAKEN, it assigns an attestation level that describes how much the carrier can verify about the call's identity.
- A — Full Attestation. The carrier certifies that the caller is the legitimate subscriber of the number displayed in caller ID and is authorised to use it. This is the strongest attestation level and is applied when the carrier has a direct relationship with the customer and can confirm the number is assigned to them.
- B — Partial Attestation. The carrier certifies that the call originated from a known customer but cannot verify that the number displayed belongs to them. This applies when the carrier knows the customer but the customer is using a number pool or presenting a number the carrier has not provisioned directly.
- C — Gateway Attestation. The call entered the IP network at a gateway and the carrier has no information about the origin of the call. This is the weakest attestation level and is common for calls originating internationally or from networks that do not participate in STIR/SHAKEN signing.
Most legitimate business calls should receive A or B attestation when using a compliant provider. C attestation increases the probability of downstream spam labeling, particularly when combined with high call volumes.
How calls get labeled "Spam Likely"
STIR/SHAKEN attestation is one input into spam labeling decisions — not the only one. The major analytics platforms that power spam labels (including Hiya, First Orion, and TNS) combine attestation data with call behaviour patterns to score calls and numbers.
Signals that push a number toward a spam label include low attestation, high call volume, short average call duration, and complaint rates from consumers who have marked the number as unwanted. A number with low attestation combined with these behaviour patterns is significantly more likely to be labeled. Conversely, a number with strong A-level attestation but aggressive dialing patterns is not immune.
STIR/SHAKEN solves the spoofing problem. Spam labeling from the analytics layer is a separate issue, and businesses need to address both. See our guide on why calls show as Spam Likely for a full breakdown of the analytics side.
What businesses need to do
For most businesses, the actions required are straightforward:
- Use a provider registered with the FCC. Your voice provider must hold an Operating Company Number (OCN) and participate in STIR/SHAKEN signing to pass A or B attestation to your calls. If your provider is not registered, your calls may receive C attestation or no signing at all. MCC's wholesale voice infrastructure participates in STIR/SHAKEN signing.
- Use numbers registered to your business entity. Numbers that are provisioned directly to your business under your legal entity support A-level attestation. Shared number pools or numbers not attributed to your account may only achieve B-level signing.
- Avoid high-volume dialing patterns on shared numbers. Even with strong attestation, numbers associated with very high call volumes and low answer rates accumulate negative signals in analytics platforms. Use dedicated numbers for outbound campaigns where volume is a factor.
- Use brand registration and CNAM services if calls are being labeled. If your calls are being labeled despite full compliance with STIR/SHAKEN, the issue is in the analytics layer, not the signing layer. Brand registration with the major analytics providers and accurate CNAM records help establish your identity and reduce false positives. This is also relevant if you are using 10DLC for business messaging, where similar registration frameworks apply.
If you have questions about how your current provider handles STIR/SHAKEN signing, or whether your numbers are receiving the correct attestation level, contact MCC to review your setup.
Frequently Asked Questions
What does STIR/SHAKEN do?
STIR/SHAKEN is a caller ID authentication framework that cryptographically signs call identity at the originating carrier and verifies it at the terminating carrier. When a call is placed, the originating carrier attaches a digital signature to the call. The terminating carrier checks that signature to confirm whether the calling number was legitimately assigned to the caller. This allows carriers to distinguish authenticated calls from spoofed ones and reduces the effectiveness of caller ID spoofing used in robocall campaigns.
What is attestation level A, B, and C?
Attestation level describes how much the originating carrier can verify about the call. Level A (Full Attestation) means the carrier certifies that the caller is the legitimate subscriber of the number and is authorised to use it. Level B (Partial Attestation) means the carrier certifies the call originated from a known customer but cannot verify that the number displayed belongs to them. Level C (Gateway Attestation) means the call entered the IP network at a gateway and the carrier has no information about the origin. Most legitimate business calls should receive A or B attestation.
Why are my calls showing as Spam Likely even with STIR/SHAKEN?
STIR/SHAKEN is one input into spam labeling decisions, not the only one. Analytics platforms such as Hiya, First Orion, and TNS combine attestation level with call behaviour signals — including call volume, call duration, complaint rates, and dialing patterns. A number with valid STIR/SHAKEN signing can still be labeled if it exhibits patterns associated with spam, such as high call volume with short average call duration. If calls from your numbers are being labeled despite using a compliant provider, review your dialing patterns and consider using a brand registration or CNAM service to establish your identity with the analytics platforms.
Is STIR/SHAKEN required by law in the US?
Yes. The TRACED Act, signed into law in 2019, directed the FCC to require voice service providers to implement STIR/SHAKEN in their IP networks. The FCC issued rules requiring all originating and terminating voice providers to implement STIR/SHAKEN. Large providers were required to comply by June 2021, and smaller providers on extended timelines thereafter. Any provider originating calls on the US telephone network is now expected to participate in the STIR/SHAKEN framework.
Does STIR/SHAKEN work for international calls?
STIR/SHAKEN operates within the US telephone network and applies to calls carried over IP networks between participating US carriers. International calls face challenges because STIR/SHAKEN requires both the originating and terminating carriers to participate in the framework. Calls originating from outside the US often enter the domestic network at a gateway with no STIR/SHAKEN signing, which typically results in C-level attestation or no attestation at all. Work is ongoing in other countries and international standards bodies to extend similar authentication frameworks, but coverage outside the US remains limited.
How does STIR/SHAKEN affect my business calls?
If your business uses a provider that is registered with the FCC, holds an Operating Company Number (OCN), and participates in STIR/SHAKEN signing, your outbound calls should receive A or B attestation and are less likely to be flagged by carrier spam filters. If your provider does not participate in STIR/SHAKEN, your calls may receive C attestation or no attestation, which increases the probability of a spam label — particularly if your numbers are associated with any volume dialing. Using a compliant provider, registering numbers to your business entity, and avoiding high-volume patterns on shared numbers are the main actions within your control.
Voice infrastructure with STIR/SHAKEN compliance
MCC provides wholesale voice and business phone infrastructure that participates in STIR/SHAKEN signing. Contact us to discuss your call authentication and compliance requirements.