STIR/SHAKEN is a framework of standards that lets phone companies digitally sign the caller ID of a call, so that the receiving network can check whether the calling number was asserted by a provider that knows the caller. It is the main defence against spoofed caller IDs in the United States and Canada. STIR stands for Secure Telephone Identity Revisited, and SHAKEN for Signature-based Handling of Asserted information using toKENs.
How does STIR/SHAKEN work?
The IETF's STIR working group defined the building blocks:
- PASSporT (RFC 8225): a signed token that carries the calling number, the called number and a timestamp.
- SIP Identity header (RFC 8224): how that token travels with a call over IP networks.
- SHAKEN extension (RFC 8588): adds the
attestclaim and an origination identifier. The attestation definitions come from the industry standard ATIS-1000074.
The originating provider signs each call with a certificate issued under an industry governance system. Each downstream network passes the signature along. The terminating provider verifies it and can show the result to the customer or use it in call-blocking analytics.
What do the attestation levels mean?
RFC 8588 lets the attest claim take one of three values:
| Level | Name | What the signing provider asserts |
|---|---|---|
| A | Full attestation | It knows the customer and that they are authorised to use the calling number |
| B | Partial attestation | It knows the customer, but not that they are authorised to use this number |
| C | Gateway attestation | It only knows where the call entered its network, often an international gateway |
What does the law require?
The FCC adopted rules in 2020 requiring voice service providers to implement STIR/SHAKEN in the IP portions of their networks by 30 June 2021. It later extended the obligation to gateway providers and to intermediate providers that receive unauthenticated calls. Separately, FCC rules (47 CFR 64.1604) prohibit transmitting misleading caller ID information with intent to defraud, cause harm or wrongfully obtain anything of value.
What doesn't STIR/SHAKEN tell you?
- Intent. A fully attested number can still run an illegal robocall campaign. Attestation proves who vouched for the number, not that the call is wanted.
- Non-IP calls. The framework only works on IP networks. Calls that cross legacy TDM links may arrive unsigned.
- International origin. Calls from abroad usually arrive with gateway attestation or none.
- The caller's name. Displayed names come from a separate system. See CNAM.
How does STIR/SHAKEN fit with number reputation?
Treat attestation as one input. Combine it with the number's reputation, its line type and your own history with the caller. MobileValidate's spam reputation check (limited access, US, CA and DE numbers) reports whether a number appears in regulator actions, government complaint data or community reports. The US and Canada carrier lookup returns the current carrier and line type. See screening inbound calls with spam reputation for a call-center workflow that uses all three.
Frequently asked questions
What do attestation levels A, B and C mean?
A (full): the originating provider knows the customer and that they may use the number. B (partial): it knows the customer but not their right to the number. C (gateway): it only knows where the call entered its network.
Does STIR/SHAKEN stop robocalls?
Not by itself. It makes spoofed caller IDs easier to detect and trace. A robocaller using its own numbers can still get full attestation.
Can I see the attestation of calls I receive?
Often. Many carriers and SIP trunk providers pass the verification result to business customers as a header or an attestation field. Ask your provider.