A Guide to STIR/SHAKEN: What It Means for Your Calls

Summary:

STIR/SHAKEN is a caller ID authentication framework that voice providers use to digitally sign and verify calls. The signing provider assigns an attestation level—A, B, or C—based on what it can confirm about the caller and their right to use the displayed number. PhoneBurner handles authentication as part of the dialing process: numbers obtained through PhoneBurner receive A attestation, while verified numbers brought to the platform receive B. Attestation can inform spam-labeling decisions, but even A-attested calls can be flagged based on other signals.

Carriers Need to Authenticate Your Calls. STIR/SHAKEN Is How They Do It.

STIR/SHAKEN is a caller ID authentication framework designed to combat spoofing, where someone displays a phone number they aren’t authorized to use. Voice providers use it to authenticate calls in the IP portions of their networks.

Calls signed under STIR/SHAKEN carry an attestation level: A, B, or C, reflecting what the signing provider can verify about the caller and their right to use the displayed number.

Attestation doesn’t prove that a call is trustworthy or wanted. It tells the receiving provider what has been verified about the caller ID, but it doesn’t determine on its own whether a call gets through or appears with a spam label.

If you’re dialing through PhoneBurner’s dialing platform, STIR/SHAKEN authentication is handled as part of the calling process; you don’t need to configure it yourself. Numbers obtained through PhoneBurner receive A attestation, while numbers you bring to the platform and verify for use as your caller ID receive B.

Here’s what those levels mean for the calls you place every day, and what else you can do to give your outbound calls the best chance of connecting.

In this guide, we’ll cover:

• Why caller ID spoofing led to STIR/SHAKEN
• How call signing works and what A, B, and C attestation mean
• How PhoneBurner handles attestation for different numbers
• Why authenticated calls can still receive spam labels
• What else you can do to protect your numbers

STIR/SHAKEN at a Glance

Why STIR/SHAKEN Was Introduced

Caller ID lets someone see a number before deciding whether to answer. But historically, the phone network had no reliable, network-wide way to check whether the person placing a call had the right to display that number. With certain calling technologies, a caller could supply a number other than their own as their outbound caller ID.

Bad actors learned to exploit that gap. By showing a familiar local number, a business’s number, or someone else’s number, they could disguise where a call really came from. This is caller ID spoofing, and it contributed to declining consumer trust in phone calls.

STIR/SHAKEN was developed to address that problem. Congress directed the FCC to require caller ID authentication in the TRACED Act of 2019. The FCC set June 30, 2021 as the initial implementation deadline for large voice providers in the IP portions of their networks, with extensions for certain other providers.

However, number spoofing is not the only tactic bad actors use, so carriers do not solely rely on STIR/SHAKEN to identify nuisance calling. They also scrutinize calls placed across their networks for a variety of signals that can indicate spam or fraud, which we’ll discuss below.

But first, let’s talk about how call authentication under STIR/SHAKEN works.

How STIR/SHAKEN Authentication Works

Under STIR/SHAKEN, the provider signing a call digitally signs information associated with it. That gives a provider on the receiving end a way to check the signature and see what the signing provider can attest to about the caller.

The signing provider assigns an attestation level based on how much it knows about the customer placing the call and the customer’s right to use the phone number being displayed.

Full, or “A,” Attestation

The provider knows the customer and can confirm they’re authorized to use the specific phone number on the call. This is the highest level of trust STIR/SHAKEN offers.

Partial, or “B,” Attestation

The provider knows the customer placing the call but can’t completely verify the customer’s right to use the specific number being used. This is common when a customer brings a phone number they already owned to a new provider.

Gateway, or “C,” Attestation

The provider passes the call onto the network but cannot authenticate the party that originated it. This may occur when a call enters through a gateway.

A call with full A attestation can appear with a checkmark or “Caller Verified” badge on the recipient’s phone, though that depends on the receiving provider and device. The badge does not guarantee that a separate carrier analytics system won’t flag the number as spam.

Calls with C attestation, or calls that arrive without usable authentication information, are likely to be treated with more suspicion. The difference between B and C is significant: with B, the signing provider knows the customer placing the call, even though it cannot independently verify that customer’s right to the displayed number. Carriers are more likely to flag or block calls suspected of spoofing, and thanks to near-instant traceback capabilities now built into the framework, the source of illegal or abusive calls can be identified and held accountable much faster than before.

How PhoneBurner Handles STIR/SHAKEN For Your Calls

Dialing through PhoneBurner means you don’t have to manage STIR/SHAKEN call signing yourself. PhoneBurner establishes which numbers you’re authorized to use, and our carrier partners sign calls placed through the platform.

The attestation level depends on whether your outbound caller ID number came from PhoneBurner or was brought to the platform:

• Numbers obtained through PhoneBurner receive A attestation. PhoneBurner provides the number, so our carrier partners can verify your right to use it when signing your calls. Learn more about buying numbers through PhoneBurner.
• Numbers you bring to PhoneBurner receive B attestation. Before you can use an existing number as your outbound caller ID, PhoneBurner verifies that you control it using a PIN. Our carrier partner can identify you as the customer placing the call, but cannot independently verify the assignment of a number obtained through another provider.

B level attestation is still a trusted signal. If your calls receive this attestation level, you can continue to use your existing caller IDs and should expect the same or similar results you experience today.

Why Attestation Does Not Prevent Spam Flags

Attestation and spam flagging are two separate systems, and clearing one doesn’t exempt you from the other.

• STIR/SHAKEN attestation addresses a question about identity: What can the signing provider verify about the caller and their right to use the displayed number?
• Spam flagging addresses a question about risk: Based on available signals, is this call likely to be unwanted, fraudulent, or a nuisance?

That’s not to say attestation has no bearing on spam labeling. It can be one signal among many. Carriers and third-party analytics providers assess numbers using calling patterns and consumer responses. Each weighs signals differently, and its criteria are not fully public. Signals they may consider include sudden spikes in call volume, short calls, a high percentage of unanswered calls, repeat dialing of the same contact, and negative consumer feedback.

Legitimate and wanted business calls can sometimes produce similar patterns. When that happens, their numbers can be mislabeled as spam, regardless of the calls’ attestation level.

Attestation still matters: It gives receiving providers useful information about the calling party. But it cannot prevent spam labels based on other signals. You also need to monitor your numbers for false flags and address them when they appear.

Related: 15 Myths About Spam Flags and Answer Rates, Busted

Monitoring and Remediating Spam Flags with ARMOR®

With so many factors influencing call reputation, more businesses are taking a proactive approach to number management.

ARMOR® is PhoneBurner’s optional number reputation and spam flag remediation feature. It monitors your numbers across major U.S. carriers and alerts you when they pick up flags. Then, our expert team remediates directly with the assigning carrier on your behalf to have false flags cleared.

ARMOR® is also available as a standalone service for businesses who don’t use PhoneBurner’s platform to dial. Our experts have identified and helped clear hundreds of thousands of flags for our clients.

What Attestation Means for Your Outbound

Consumers should have confidence in the number they see on their screen. STIR/SHAKEN helps by giving receiving providers information about who placed the call and their right to use the displayed number. It also gives analytics engines an important signal when assessing whether a call should get through, be labeled as spam, or be blocked outright.

But caller ID authentication alone cannot tell consumers whether a call is one they want to receive, and it cannot prevent legitimate calls from being mislabeled as spam.

That’s why successful outbound calling takes more than authentication. It takes responsible calling practices and attention to how your numbers appear to the people you’re trying to reach. PhoneBurner helps you place authenticated calls, while ARMOR® helps you monitor your numbers and address false spam labels when they arise.

Start a free trial of PhoneBurner to see how our dialer supports your outbound calling today.

Frequently Asked Questions

Does PhoneBurner handle STIR/SHAKEN attestation for me?

PhoneBurner’s carrier partners handle call signing and attestation automatically for every call routed through the platform, so there’s no setup or ongoing configuration required from you. Your only obligation is caller ID verification: any number you set as your outbound caller ID has to be one you own or are authorized to use, and PhoneBurner verifies that before the number can be used.

What are the differences between A, B, and C attestation for STIR/SHAKEN?

A means the originating provider can attest to your identity and your right to use the number you’re calling from. B means it can vouch for you as a known customer but can’t confirm the true ownership of that  specific number. C means the carrier put the call on the network but can’t authenticate where it originated. A is the only level that can trigger a “Caller Verified” badge on devices that display one, but the difference between A and B is far smaller than the difference between B and C. Calls arriving with C attestation are the ones most likely to be flagged or blocked.

Does “A” attestation or a “Caller Verified” checkmark guarantee my calls won’t be marked as spam?

No. Attestation and spam flagging are separate systems.  While attestation is one factor that carriers look at when assigning labels, their spam-analytics engines process numerous other call signals and behaviors as well as consumer feedback. Even calls that carry full attestation can be considered unexpected, unwanted, unsafe, or otherwise deserving of a spam/scam label.

Will using my own existing phone number affect my attestation level?

Yes. When you obtain a number through PhoneBurner, our carrier partners can verify your right to use it and sign calls from that number with A attestation.

You can also bring an existing number to PhoneBurner. We verify that you control it before you use it as your caller ID, but because it was obtained through another provider, our signing carrier cannot independently verify its assignment. Calls from that number receive B attestation. You can still use the number your contacts already recognize.

Will STIR/SHAKEN by itself stop my numbers from ever being flagged as spam?

Not on its own. STIR/SHAKEN reduces the risk of your calls being mistaken for spoofed traffic, but carrier spam-flag decisions also weigh other factors like call engagement, behavioral patterns, and consumer complaints. For more on reducing flag risk specifically, see PhoneBurner’s guide to  monitoring and removing spam flags.

What should I do if my calls are still getting flagged despite proper attestation?

Turn on ARMOR® within your PhoneBurner account. It monitors your numbers across major carriers and handles remediation directly with the carriers that assign spam flags on your behalf. Remediation can clear falsely assigned spam flags from your numbers so you can continue dialing normally with them.

‍