Understanding STIR/SHAKEN: How VoIP Fights Robocalls and Caller ID Spoofing

Robocalls and caller ID spoofing have evolved from minor annoyances into a crisis undermining telephone communication itself. Consumers increasingly refuse to answer calls from unknown numbers, causing legitimate businesses to suffer connection rates below 20 percent for outbound sales and service calls. Regulatory bodies worldwide have responded with aggressive enforcement actions and mandatory technical standards. In the United States, the TRACED Act mandates implementation of STIR/SHAKEN caller ID authentication as the primary technical defense against illegal spoofing.

For businesses using VoIP technology, understanding STIR/SHAKEN is no longer optional. This framework directly impacts call deliverability, brand reputation, and regulatory compliance. Whether your organization makes hundreds or millions of outbound calls monthly, STIR/SHAKEN implementation affects whether recipients see your legitimate calls as verified and trustworthy—or as potential spam that goes straight to voicemail.

What Are STIR and SHAKEN?

STIR and SHAKEN are complementary technologies that work together to authenticate caller ID information and prevent spoofing. Despite the playful acronym suggesting cocktail preparation, these protocols represent serious telecommunications infrastructure designed to restore trust in voice calling.

STIR: Secure Telephone Identity Revisited

STIR is the technical protocol defining how telephone service providers cryptographically sign and verify caller ID information. Developed by the Internet Engineering Task Force (IETF), STIR provides the underlying standards for:

• Digitally signing outbound calls with authenticated caller ID tokens
• Transmitting verification tokens across carrier networks
• Validating incoming call signatures at termination points
• Generating attestation levels indicating caller ID verification confidence

SHAKEN: Signature-based Handling of Asserted Information Using Tokens

SHAKEN defines the operational framework for implementing STIR protocols within telephone networks. While STIR provides the technical specifications, SHAKEN establishes the governance structure specifying:

• How service providers register and manage digital certificates
• Governance authorities overseeing certificate issuance and trust
• Operational procedures for signing, transmitting, and verifying calls
• Dispute resolution processes for authentication failures

Together, STIR/SHAKEN creates an ecosystem where originating telephone providers cryptographically attest that callers are authorized to use the numbers they display. Terminating providers verify these attestations and display verification status to recipients, enabling informed decisions about whether to answer.

How STIR/SHAKEN Works: The Technical Process

Understanding the STIR/SHAKEN workflow helps businesses appreciate both its protective capabilities and implementation requirements.

Step 1: Call Origination and Authentication

When a caller places an outbound call, the originating service provider authenticates the caller ID:

• The provider verifies the caller's right to use the displayed number
• The provider generates a digital signature using its secure certificate
• The provider attaches the signature and attestation level to the call signaling

Step 2: Attestation Levels

STIR/SHAKEN assigns three attestation levels indicating verification confidence:

• Full Attestation (A): The provider verifies the customer is using a number they legitimately possess and can originate calls from that number. This highest level typically applies to direct customers with verified number assignments.
• Partial Attestation (B): The provider verifies the customer but cannot confirm they legitimately possess the specific number being used. This might apply to calls forwarded through third-party services.
• Gateway Attestation (C): The provider originates the call but cannot authenticate the caller or number relationship. This lowest level applies to international gateways or unverified resellers.

Step 3: Cross-Network Transmission

As the call traverses carrier networks toward its destination, the authentication token travels with it:

• Intermediate carriers pass the verification token unchanged
• Signaling systems carry STIR/SHAKEN information using SIP identity headers
• Network equipment preserves authentication data throughout transmission

Step 4: Verification and Display

The terminating provider receiving the call validates the authentication:

• The provider checks the digital signature against the originating provider's certificate
• The provider confirms the certificate's validity through governance authority databases
• The provider passes verification status to the recipient's phone or service
• The recipient sees a verification indicator such as "Verified" or a checkmark

The Robocall and Spoofing Problem STIR/SHAKEN Addresses

To appreciate STIR/SHAKEN's importance, consider the scale of the problem it confronts.

Prevalence of Illegal Robocalls

Automated calling technology enables bad actors to place millions of calls at minimal cost:

• Americans receive approximately 4 billion robocalls monthly
• Fraudulent robocalls cause billions of dollars in consumer losses annually
• Healthcare scams, IRS impersonation, and tech support fraud dominate complaint categories
• Small businesses suffer reputational damage when scammers spoof their numbers

Caller ID Spoofing Mechanics

Spoofing falsifies the caller ID displayed to recipients:

• Neighbor spoofing displays numbers matching the recipient's area code and prefix
• Enterprise spoofing impersonates legitimate businesses including banks and government agencies
• Number hijacking temporarily takes over legitimate business numbers for scam campaigns
• International spoofing masks foreign origins to appear domestic

These techniques exploit the traditional telephone network's trust-based caller ID system, which transmitted identification information without authentication mechanisms.

Erosion of Answer Rates

As spoofing proliferates, consumer behavior adapts defensively:

• Answer rates for unknown numbers plummet across all industries
• Legitimate businesses experience declining contact rates for appointment reminders, delivery notifications, and service calls
• Call blocking applications increasingly flag unverified numbers automatically
• Consumer complaints to regulators pressure carriers to block suspicious traffic

Regulatory Requirements and Compliance Timelines

Governments worldwide have mandated STIR/SHAKEN implementation through legislation and regulatory orders.

United States: The TRACED Act

The Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, signed December 2019, mandates:

• FCC orders requiring voice service providers implement STIR/SHAKEN
• Deadlines for large carriers (June 2021) and smaller providers (June 2023, with some extensions)
• Penalties up to $10,000 per illegal robocall
• Requirements for intermediate providers to authenticate and pass verification tokens

Canada

The Canadian Radio-television and Telecommunications Commission (CRTC) mandates:

• STIR/SHAKEN implementation for major telecommunications service providers
• Technical and operational standards aligned with U.S. frameworks
• Progress reports documenting deployment milestones

International Developments

Other jurisdictions developing caller ID authentication frameworks include:

• United Kingdom Ofcom exploring technical standards
• European Union considering authentication requirements in electronic communications codes
• Asian telecommunications regulators monitoring STIR/SHAKEN effectiveness

Business Implications of STIR/SHAKEN

STIR/SHAKEN implementation significantly affects business VoIP operations beyond simple regulatory compliance.

Outbound Call Deliverability

Verified calls reach recipients more reliably than unverified alternatives:

• Carriers increasingly block or label unverified traffic as potential spam
• Call analytics services incorporate verification status into reputation scoring
• Phone manufacturers display verification indicators prominently on incoming call screens
• Enterprises with Full Attestation experience measurably higher answer rates

Brand Protection

When scammers spoof business numbers, legitimate organizations suffer collateral damage:

• Consumers associate spoofed scam calls with impersonated brands
• Return call volume to victimized businesses increases with confused or angry consumers
• Brand trust erodes even when businesses bear no responsibility for scams
• STIR/SHAKEN verification distinguishes legitimate calls from spoofed impersonations

Litigation and Regulatory Risk

Businesses making outbound calls face intensifying scrutiny:

• TCPA lawsuits continue increasing with substantial damage awards
• State attorneys general pursue aggressive robocall enforcement
• FCC orders target both illegal robocallers and originating providers
• Compliance documentation requirements expand for calling campaigns

Customer Experience Enhancement

Verified calling improves customer communication outcomes:

• Customers answer legitimate service and appointment calls promptly
• Verification badges increase confidence in telephone-based transactions
• Reduced friction in telephone customer journeys improves satisfaction scores
• Proactive outreach campaigns achieve higher engagement rates

Implementing STIR/SHAKEN in Business VoIP Environments

Businesses do not implement STIR/SHAKEN directly but must ensure their telecommunications providers and systems support proper authentication.

Verify Provider STIR/SHAKEN Support

When selecting or evaluating VoIP providers:

• Confirm the provider participates in STIR/SHAKEN governance frameworks
• Verify the provider assigns appropriate attestation levels to your traffic
• Request documentation of authentication capabilities and deployment status
• Understand whether the provider acts as an originating, terminating, or intermediate carrier

Caller ID Management

Achieving Full Attestation requires proper caller ID management:

• Use telephone numbers legitimately assigned to your organization
• Register numbers with your originating provider under your business identity
• Avoid number substitution or manipulation that triggers Partial Attestation
• Maintain accurate numbering documentation for verification purposes

Monitor Verification Status

Businesses should actively monitor how their calls appear to recipients:

• Test calls across major carrier networks checking verification displays
• Use call analytics platforms tracking answer rates by network and verification status
• Investigate calls receiving lower attestation levels than expected
• Address authentication failures promptly with service providers

Integrate with Compliance Programs

STIR/SHAKEN complements broader telecommunications compliance:

• Maintain accurate do-not-call list scrubbing procedures
• Document consent for all outbound calling campaigns
• Record keeping supporting lawful purpose for each call
• Regular compliance audits verifying adherence to applicable regulations

Challenges and Limitations of STIR/SHAKEN

While transformative, STIR/SHAKEN does not eliminate all unwanted calling problems.

Implementation Gaps

Full network deployment remains incomplete:

• Smaller rural carriers received implementation extensions
• Some international gateways lack authentication capabilities
• Legacy TDM network interconnections complicate token transmission
• Gateway-level attestations provide weaker verification than Full Attestation

Legitimate Use Cases Affected

Certain legitimate calling scenarios face attestation challenges:

• Call centers using multiple originating providers for single numbers
• Businesses forwarding calls through third-party platforms
• Unified communications services aggregating multiple number sources
• International calling with complex routing arrangements

Continued Spoofing Through Non-IP Networks

STIR/SHAKEN primarily protects IP-based voice networks:

• Legacy circuit-switched connections may lack authentication
• Some international routes bypass STIR/SHAKEN verification
• Fraudulent actors continuously adapt techniques exploiting remaining gaps
• Complementary measures including call analytics and blocking remain necessary

How New Rock Technologies Supports STIR/SHAKEN Compliance

New Rock Technologies recognizes that STIR/SHAKEN compliance is essential for businesses maintaining trusted communication with customers and partners. New Rock's VoIP infrastructure products are designed to integrate seamlessly with service provider STIR/SHAKEN implementations, ensuring businesses achieve optimal attestation levels for their outbound calling traffic.

New Rock Technologies provides critical capabilities supporting caller ID authentication:

• Full SIP protocol compliance ensuring seamless transmission of STIR/SHAKEN identity headers across New Rock VoIP gateways and session border controllers, preserving authentication tokens as calls traverse enterprise network boundaries
• Flexible caller ID configuration options that allow businesses to properly associate legitimate telephone numbers with their outbound calling profiles, supporting the number ownership verification necessary for Full Attestation
• Interoperability testing with major telecommunications carriers and SIP trunking providers to verify STIR/SHAKEN token passage and prevent authentication stripping or degradation within enterprise infrastructure
• Secure network architecture incorporating TLS encryption for SIP signaling, protecting authentication tokens from interception or tampering as they travel between enterprise equipment and service provider networks
• Detailed call logging and diagnostic capabilities that enable administrators to trace verification status through their infrastructure, identifying any points where attestation levels might be affected
• Forward-compatible platform design accommodating evolving STIR/SHAKEN standards, governance authority requirements, and certificate management protocols as the framework matures

By deploying New Rock Technologies VoIP solutions, businesses ensure their internal communication infrastructure supports rather than undermines service provider authentication efforts. This alignment maximizes the probability that legitimate business calls receive Full Attestation and display verified status to called parties.

Conclusion

STIR/SHAKEN represents a fundamental shift in telephone network architecture—from trust-based caller ID transmission to cryptographically verified authentication. For businesses relying on voice communication, this transition carries profound implications for call deliverability, brand reputation, and regulatory compliance.

Organizations must engage proactively with their VoIP providers to ensure proper STIR/SHAKEN implementation, appropriate attestation levels, and ongoing monitoring of verification status. Those who neglect this evolving landscape risk seeing their legitimate outbound calls blocked, labeled as spam, or simply ignored by consumers trained to distrust unverified numbers.

As the global telecommunications community continues strengthening caller ID authentication, businesses equipped with STIR/SHAKEN-aware infrastructure and compliant calling practices will enjoy sustainable competitive advantages in customer reach and communication effectiveness.