If you’ve noticed calls labeled “Scam Likely” or seen a checkmark next to a caller’s name, you’ve encountered the results of STIR/SHAKEN — a framework US carriers use to verify whether a caller’s displayed number is legitimate or likely spoofed.
What STIR/SHAKEN Actually Stands For
STIR/SHAKEN combines two technical standards:
- STIR (Secure Telephone Identity Revisited) — the underlying technical protocol for verifying caller identity
- SHAKEN (Signature-based Handling of Asserted information using toKENs) — the framework that implements STIR across carrier networks
Together, they let carriers cryptographically sign and verify that a call’s displayed caller ID actually originates from the number it claims to be from.
Why This Framework Exists
Caller ID spoofing — displaying a fake or manipulated number to disguise the real origin of a call — has long been used to facilitate robocalls and phone-based scams. Because spoofing was historically easy and inexpensive to do at scale, US regulators pushed for a technical solution that carriers could implement across the network, rather than relying solely on consumer-side call-blocking apps.
The FCC has mandated STIR/SHAKEN implementation for major US voice service providers, making it a regulatory requirement rather than an optional carrier feature.
How STIR/SHAKEN Works, Simplified
- A call originates from a phone number through a carrier’s network
- The originating carrier attaches a digital “attestation” — essentially a cryptographic signature indicating how confident it is that the caller is authorized to use that number
- This signed information travels with the call as it passes to the terminating carrier (the one delivering the call to the recipient)
- The receiving carrier verifies the signature and can use this information to label the call (e.g., flagging it as potentially spoofed) or factor it into robocall-blocking systems
The Three Attestation Levels
STIR/SHAKEN uses three levels of confidence:
- Full Attestation (A) — the carrier has verified the caller is authorized to use that specific number
- Partial Attestation (B) — the carrier knows the caller but can’t fully verify their right to use that specific number
- Gateway Attestation (C) — the call entered the carrier’s network from an untrusted source, and origin can’t be verified
Lower attestation levels are one factor (among several) that call-blocking and labeling systems use to flag potentially suspicious calls.
What This Means for Everyday Calls
It doesn’t eliminate spam calls entirely. STIR/SHAKEN verifies caller ID authenticity, but it doesn’t evaluate call intent — a fully authenticated number can still be used to make an unwanted telemarketing or scam call, since attestation confirms identity, not legitimacy of purpose.
International calls face limitations. STIR/SHAKEN is primarily a US-focused framework, and its effectiveness decreases for international calls routed through carriers outside this system.
It’s a network-level protection, not something users configure. Unlike call-blocking apps, STIR/SHAKEN operates at the carrier infrastructure level, so there’s no consumer setting to enable or disable it directly.
Frequently Asked Questions
Does STIR/SHAKEN stop all robocalls?
No — it verifies whether a caller ID is authentic, but it doesn’t judge whether a call’s purpose is legitimate. A verified, authenticated number can still be used for unwanted calls.
Is STIR/SHAKEN used outside the United States?
Some countries have developed similar caller authentication frameworks, but STIR/SHAKEN specifically is a US-focused standard mandated by the FCC, and its direct interoperability with international systems is limited.
Why do some calls still show as “Scam Likely” if STIR/SHAKEN is implemented?
Carriers combine attestation data with other signals (calling patterns, complaint data, and more) to generate these labels — a low attestation level is one input among several, not the sole factor.
Do I need to do anything to benefit from STIR/SHAKEN?
No — implementation happens at the carrier network level, so consumers don’t need to enable any settings to benefit from it.
Does STIR/SHAKEN affect text messages too?
No, STIR/SHAKEN specifically addresses voice call authentication. SMS messaging has separate industry frameworks (like A2P 10DLC registration) addressing spam and fraud prevention.
