# STIR/SHAKEN

> STIR/SHAKEN is the caller ID authentication framework used in US and Canadian phone networks. How attestation levels A, B and C work and what they don't tell you.

Canonical: https://mobilevalidate.com/glossary/stir-shaken · Last updated: 2026-09-25

![A shield and a risk gauge pointing into the high range, with an incoming call flagged as risky.](https://mobilevalidate.com/images/spam-reputation-risk-score.svg)

*Spam reputation gives a risk level and the reasons behind it, where the service is enabled.*


STIR/SHAKEN is a framework of standards that lets phone companies digitally sign the caller ID of a call, so that the receiving network can check whether the calling number was asserted by a provider that knows the caller. It is the main defence against spoofed caller IDs in the United States and Canada. STIR stands for Secure Telephone Identity Revisited, and SHAKEN for Signature-based Handling of Asserted information using toKENs.

## How does STIR/SHAKEN work?

The IETF's STIR working group defined the building blocks:

- **PASSporT** ([RFC 8225](https://www.rfc-editor.org/rfc/rfc8225)): a signed token that carries the calling number, the called number and a timestamp.
- **SIP Identity header** ([RFC 8224](https://www.rfc-editor.org/rfc/rfc8224)): how that token travels with a call over IP networks.
- **SHAKEN extension** ([RFC 8588](https://www.rfc-editor.org/rfc/rfc8588)): adds the `attest` claim and an origination identifier. The attestation definitions come from the industry standard ATIS-1000074.

The originating provider signs each call with a certificate issued under an industry governance system. Each downstream network passes the signature along. The terminating provider verifies it and can show the result to the customer or use it in call-blocking analytics.

## What do the attestation levels mean?

RFC 8588 lets the `attest` claim take one of three values:

| Level | Name | What the signing provider asserts |
|---|---|---|
| A | Full attestation | It knows the customer and that they are authorised to use the calling number |
| B | Partial attestation | It knows the customer, but not that they are authorised to use this number |
| C | Gateway attestation | It only knows where the call entered its network, often an international gateway |

## What does the law require?

The FCC [adopted rules in 2020](https://www.fcc.gov/call-authentication) requiring voice service providers to implement STIR/SHAKEN in the IP portions of their networks by 30 June 2021. It later extended the obligation to gateway providers and to intermediate providers that receive unauthenticated calls. Separately, FCC rules ([47 CFR 64.1604](https://www.ecfr.gov/current/title-47/section-64.1604)) prohibit transmitting misleading caller ID information with intent to defraud, cause harm or wrongfully obtain anything of value.

## What doesn't STIR/SHAKEN tell you?

- **Intent.** A fully attested number can still run an illegal robocall campaign. Attestation proves who vouched for the number, not that the call is wanted.
- **Non-IP calls.** The framework only works on IP networks. Calls that cross legacy TDM links may arrive unsigned.
- **International origin.** Calls from abroad usually arrive with gateway attestation or none.
- **The caller's name.** Displayed names come from a separate system. See [CNAM](/glossary/cnam).

## How does STIR/SHAKEN fit with number reputation?

Treat attestation as one input. Combine it with the number's reputation, its [line type](/glossary/line-type) and your own history with the caller. MobileValidate's [spam reputation](/services/spam-reputation) check (limited access, US, CA and DE numbers) reports whether a number appears in regulator actions, government complaint data or community reports. The [US and Canada carrier lookup](/services/us-carrier-lookup) returns the current carrier and line type. See [screening inbound calls with spam reputation](/blog/screening-inbound-calls-with-spam-reputation) for a call-center workflow that uses all three.

## Frequently asked questions

### What do attestation levels A, B and C mean?

A (full): the originating provider knows the customer and that they may use the number. B (partial): it knows the customer but not their right to the number. C (gateway): it only knows where the call entered its network.

### Does STIR/SHAKEN stop robocalls?

Not by itself. It makes spoofed caller IDs easier to detect and trace. A robocaller using its own numbers can still get full attestation.

### Can I see the attestation of calls I receive?

Often. Many carriers and SIP trunk providers pass the verification result to business customers as a header or an attestation field. Ask your provider.