What Is STIR/SHAKEN?:
Everything You Need to Know

In 2023, phone-related scam attempts reached an all-time high in cases and damages alike¹. This led regulators to implement laws targeting outbound calls specifically. 

But what do these restrictions mean for businesses relying on outbound customer service and sales?

We take our phones everywhere, but that also makes us easy targets for scams, spoofed calls, and data breaches. With AI, scammers can now even fake voices, putting both consumers and businesses at risk. 

If your business makes outbound calls, you don’t want to get mixed up with fraudsters. That’s where STIR/SHAKEN comes in. This technology helps verify caller IDs and fight spoofing and robocalls. 

In this article, we’ll explain what STIR/SHAKEN is, how it works, and why it matters for your business.

Key Takeaways:

• STIR/SHAKEN helps stop spoofed calls. Scammers love faking caller IDs but these regulations make it way harder for them to trick you. It verifies calls so you can trust who’s really calling.
  
• STIR/SHAKEN are regulations that help ensure your number isn’t flagged as spam so more customers actually pick up. This is especially important if your business makes outbound calls.
  
• Not all calls are safe yet. While STIR/SHAKEN reduces fraud, it’s not perfect. Some scams still slip through, so businesses should combine them with other security measures.
  
• You don’t have to do anything. As a business, your phone carrier handles STIR/SHAKEN for you. Businesses just need to make sure they’re using a provider that follows the rules.

What Is STIR/SHAKEN?

STIR/SHAKEN is a call authentication framework designed to combat caller ID spoofing and robocalls. This call authentication framework helps verify that the number you see on your screen is actually coming from a legitimate source.

Ever gotten a call that looked like it was from a service provider you have a subscription with, only to pick up and realize it was a scam? That’s exactly the kind of fraud STIR/SHAKEN is designed to stop.

As of June 30, 2021, the FCC (Federal Communications Commission) requires carriers to implement STIR/SHAKEN authentication to reduce fraudulent calls and improve trust in voice communications. While many businesses have integrated this technology for outbound calls, inbound call verification is still catching up.

What is STIR/SHAKEN authentication? Essentially, it is a protocol that helps verify the legitimacy of a call by assigning an attestation level based on the carrier’s knowledge of the caller. 

Alternatively, the STIR/SHAKEN protocol consists of technical standards and a governance framework that telecom providers use to authenticate calls. Let’s take a closer look at the terminology that goes into SRIR/SHAKEN compliance here:

STIR

STIR (Secure Telephony Identity Revisited) is a set of standards developed by the IETF that ensures a caller is authorized to use a specific phone number. STIR phone numbers help prevent fraudsters from spoofing legitimate numbers.

SHAKEN

SHAKEN (Signature-based Handling of Asserted information using toKENs) is the framework that governs how caller ID verification works. It defines attestation levels by making sure that calls can be trusted based on the carrier’s relationship to the phone number.

How Does STIR/SHAKEN Make a Difference?

Robocalls and spoofed numbers are on the rise, which makes it harder for businesses and consumers to trust incoming calls. STIR/SHAKEN call authentication helps verify that the caller ID matches the actual caller. This reduces fraud while restoring trust in phone communication.

The Impact of Fraudulent Calls

Scammers use caller ID spoofing to impersonate banks, government agencies, and businesses, tricking people into giving away sensitive information. This leads to financial losses. But that’s not all. It also tarnishes the trust people have in legitimate business calls.

How Businesses Are Affected

Many businesses are seeing their legitimate calls mislabeled as spam or blocked, making it harder to reach customers. This affects sales, customer service, and overall business operations. To combat this, companies can now sign their own calls to ensure end-to-end call authentication and better call treatment.

Government & Industry Response

The FCC STIR/SHAKEN mandate requires telecom providers to implement STIR/SHAKEN technology in their networks to combat fraud. However, some fraudulent calls still get through, and legitimate business calls are sometimes blocked.

How Does STIR/SHAKEN Work?

STIR/SHAKEN uses digital certificates to make sure a phone number isn’t faked. It works by verifying that the caller ID you see is legit, assigning an attestation level, and running the call through a series of security checks between service providers.

Here’s how the process works, step by step:

Step 1: Call Initiation

When a call is made, the originating service provider receives a SIP INVITE (a request to start a call). This is the first step in verifying whether the caller is legitimate.

Step 2: Attestation Level Assignment

The service provider checks the caller’s information and assigns one of three STIR/SHAKEN attestation levels:

• Full Attestation (A): The caller is verified, and they are authorized to use the number.
• Partial Attestation (B): The caller is verified, but the provider can’t confirm they are authorized to use the number.
• Gateway Attestation (C): The caller is unknown, often from an international gateway.

Step 3: Digital Signature Creation

The caller’s identity is signed with a digital certificate, creating a SIP Identity header. This header contains:

• Calling and called numbers
• Timestamp
• STIR/SHAKEN caller ID
• Attestation level
• Origination identifier

Step 4: Call Transmission

The call is passed to the terminating service provider along with the SIP Identity header. If needed, the Identity token may be sent separately via Out-of-Band SHAKEN for non-SIP networks.

Step 5: Verification & Authentication

The terminating service provider retrieves the caller’s digital certificate from a public repository and verifies:

• The Identity header matches the SIP INVITE message.
• The digital signature is valid.
• The certificate chain of trust is intact.

Step 6: Call Completion

If all checks pass, the call proceeds to the recipient with a verified caller ID. If verification fails, the call may be blocked or labeled as potential spam.

What are the STIR/SHAKEN requirements?  

To use STIR/SHAKEN, phone service providers need to meet a few key FCC requirements and register with the right organizations.

First, they must:

• Have an up-to-date 499-A Form on file with the FCC
• Have a valid Operating Company Number (OCN)
• Register in the FCC Robocall Mitigation Database (RMDB) to confirm what steps they’ve taken to stop robocalls and implement STIR/SHAKEN

To fully take part in the STIR/SHAKEN system, providers also need to:

• Register with the Policy Administrator (STI-PA) – This confirms they’re a legitimate carrier.
• Choose a Certification Authority (STI-CA) – This ensures only eligible providers get certificates.
• Get an SPC Token from the STI-PA – This token lets them request a certificate.
• Request a certificate from an approved STI-CA – This is needed to digitally sign and verify calls.

Benefits of STIR/SHAKEN for Businesses and Consumers

While STIR/SHAKEN implementation isn’t a complete solution to fraud, it’s a big step in fighting robocalls and restoring trust in phone communications. Businesses and consumers alike benefit from safer, more reliable calls.

We are talking higher call security, trust, and efficiency, benefiting both businesses and consumers; It’s a win-win. Here’s what it offers to both in more details:

STIR/SHAKEN Protocol Benefit For Consumers

• Fewer Robocalls and Scams: STIR/SHAKEN reduces robocalls by blocking calls with spoofed caller IDs. This means fewer interruptions and a lower risk of falling victim to phone scams.
  
• More Trustworthy Caller IDs: Consumers can trust incoming calls because STIR/SHAKEN ensures that the number displayed matches the actual caller. This helps people avoid spoofed calls and prioritize legitimate ones.
  
• Better Protection Against Fraud: Fraudsters often use fake numbers to trick people into giving up sensitive information. STIR/SHAKEN caller ID verification makes these scams harder to pull off, keeping consumers safer.

Benefits of STIR/SHAKEN Protocol For Businesses

• More Answered Calls & Better Customer Trust: With STIR/SHAKEN authentication, businesses’ outbound calls are less likely to be marked as spam, making it easier to reach customers and improve engagement.
  
• Stronger Fraud Protection: Businesses using STIR/SHAKEN compliance can reduce spoofed calls that impersonate their brand, helping protect customers from scams and avoiding reputational damage.
  
• Improved Call Center Efficiency: Inbound call authentication allows businesses to verify legitimate customers before they reach an agent. This also means creating much-needed blacklists and reducing identity verification time.

STIR/SHAKEN: What It Fixes and Where It Falls Short

STIR/SHAKEN is a powerful tool in the fight against spoofed calls and robocalls, but it’s not a perfect solution. It helps verify caller IDs and improve call trustworthiness, but scammers are always looking for new ways to bypass security measures.

What STIR/SHAKEN Can Solve

• Increases Call Answer Rates: When businesses use STIR/SHAKEN caller ID and register their numbers, customers are more likely to trust and answer their calls instead of sending them to voicemail.
  
• Enhances Brand Reputation: Authenticated numbers show customers that a business takes security seriously. STIR/SHAKEN authentication helps prevent brand impersonation and reinforces trust.
  
• Improves Compliance with Regulations: Many countries now require STIR/SHAKEN compliance. The FCC STIR/SHAKEN rules mandate providers to implement it and certify their participation in the Robocall Mitigation Database to prevent fraud.
  

Where STIR/SHAKEN Falls Short

• Eliminating All Robocalls: While STIR/SHAKEN robocall protections help block spoofed numbers, scammers can still use other tactics, such as legitimate but fraudulent registered numbers.
  
• Stopping Every Type of Fraud: STIR/SHAKEN verifies caller ID, but it can’t guarantee the caller’s intent. Businesses should use additional fraud prevention measures like call screening and real-time monitoring.
  
• Ensuring All Calls Are Delivered: Some legitimate business calls may still fall under suspicion. This usually happens if they lack proper STIR/SHAKEN attestation or additional call authentication solutions.

How STIR/SHAKEN Helps Stop Common Phone Scams

Can STIR/SHAKEN stop scammers from spoofing phone numbers? The short answer is no. But it can make it harder for fraudsters to trick people into giving away sensitive information. While it won’t stop all scams, it makes it much easier to detect and block suspicious calls.

Phishing

Scammers pretend to be from banks, credit card companies, or government agencies to steal sensitive information like passwords or account details. STIR/SHAKEN caller ID verification helps prevent these attacks by ensuring the caller ID matches the actual source.

Vishing (Voice Phishing)

This is phishing but over the phone. Scammers impersonate legitimate professionals to get people to hand over financial details or personal info. With STIR/SHAKEN authentication, phone providers can confirm whether an incoming call’s number is real or spoofed.

Tech Support Scams

Scammers claim to be from tech support, saying there’s an issue with your computer or software. They trick people into giving remote access or installing malware. STIR/SHAKEN compliance helps flag fraudulent calls before they reach potential victims.

Robocalls

Automated pre-recorded calls can be legal (like payment reminders), but many are scams. Fraudsters often spoof numbers to make their calls seem trustworthy. STIR/SHAKEN robocall protection helps label or block these fake calls so they don’t reach consumers.

Is STIR/SHAKEN Mandatory?

Yes, STIR/SHAKEN is mandatory for all service providers in the U.S. to help combat caller ID spoofing and robocalls. The FCC requires all carriers to certify their compliance in the Robocall Mitigation Database, ensuring they are taking action to stop fraudulent calls.

What does this mean for your businesses?

Businesses don’t need to take any direct action to be STIR/SHAKEN compliant. This responsibility falls on service providers. However, businesses should still be aware of how STIR/SHAKEN implementation affects their call deliverability and trust with customers.

So what happens if a provider isn’t registered?

Providers had to certify compliance or outline alternative robocall mitigation steps by September 28, 2021. Unregistered providers risk having their calls blocked by other networks. Additionally, carriers must cooperate with the FCC, law enforcement, and ITG to investigate illegal robocalls.

Keep Your Calls Safe & Your Customers Engaged

Robocalls and spoofing aren’t going away, but with STIR/SHAKEN, your business can stay ahead. When your calls get through and aren’t flagged as spam, it means better connections, more answered calls, and stronger trust with customers.

CloudTalk makes it easy. With number protection, smart dialing, and real-time insights, you can direct your efforts toward growing your business.

Sources:

1. Payment Journal