What is STIR/SHAKEN & How Does It Work?

STIR/SHAKEN is a set of call authentication standards created to stop caller ID spoofing and reduce scam calls.

STIR (Secure Telephony Identity Revisited) defines how a digital signature is created for each call. And, SHAKEN (Signature-based Handling of Asserted information using toKENs) explains how phone carriers implement STIR across their networks.

Together, these standards allow phone service providers to verify that the caller ID shown on your phone is accurate and not faked. When a call is made, the originating carrier attaches a digital certificate to confirm the caller’s identity. The receiving carrier then checks this certificate before delivering the call. If everything matches, the call may even display as “Caller Verified.”
 

STIR/SHAKEN verifies caller ID information to make sure the number you see on your phone is real. It uses digital certificates to confirm whether the call is genuine. Here’s how it works:

STIR/SHAKEN helps prevent common types of spoofing-based scams. These include government impersonation scams, financial institution fraud, neighbor spoofing using local-looking numbers, healthcare and insurance scams, utility and service provider scams, and business number spoofing. Verifying caller IDs makes these fraudulent calls easier to detect.

Scammers often pretend to represent government agencies like the IRS (Internal Revenue Service), HMRC (His Majesty's Revenue and Customs), or the Social Security Administration. They may claim you owe back taxes, threaten arrest, or demand immediate payment with gift cards or wire transfers.

With STIR/SHAKEN in place, spoofed numbers that appear to belong to government offices are far less likely to be trusted or delivered as verified.

Banks and credit card companies are common targets for spoofers. Fraudsters may pretend to be calling from your bank, warning of “suspicious activity,” and asking for account numbers, PINs, or one-time passcodes. STIR/SHAKEN gives financial institutions greater protection, as their numbers can be verified, making it easier for customers to distinguish a real bank call from a scam.

One of the most common techniques is neighbor spoofing, where scammers display a number with the same area code and prefix as the recipient’s. People are more likely to answer because the call looks local. STIR/SHAKEN helps block these spoofed numbers from showing up as legitimate, reducing the success of this tactic.

Fraudsters sometimes pose as hospitals, clinics, or health insurers. They may offer fake medical plans, request insurance details, or demand urgent payments for supposed medical bills. With caller ID authentication, real healthcare providers can be verified, making it much harder for impostors to gain trust.

Fraudsters may pose as electricity, gas, or internet providers. They often threaten to disconnect services unless an immediate payment is made. Caller ID authentication under STIR/SHAKEN reduces the chance that fake utility numbers appear as trusted calls, protecting people from these urgent scare tactics.

Sometimes scammers hijack the number of a real business to make fraudulent calls. This not only harms the victim but also damages the company’s reputation. With STIR/SHAKEN, businesses can have their numbers verified, preventing misuse and keeping their brand trustworthy.

STIR/SHAKEN ensures stronger protection against spoofed scam calls, a more trustworthy caller ID with verified numbers, and higher call answer rates for businesses. It also helps safeguard brand reputation by preventing misuse of company numbers and supports regulatory compliance with FCC rules.

• Stronger Protection Against Scams: Consumers are less likely to fall for spoofed calls pretending to be from banks, government agencies, or service providers. Verified caller IDs make scams easier to identify and ignore.
• More Trustworthy Caller ID: When people see a “Caller Verified” label, they know the number displayed is accurate. This simple step helps rebuild confidence in answering phone calls, which has declined in recent years.
• Higher Answer Rates for Businesses: Many calls go unanswered today because people fear spam. STIR/SHAKEN enables businesses that use authenticated numbers to be more likely to have their calls answered. This is critical for sales teams, customer service departments, healthcare providers, and financial institutions.
• Protection for Brand Reputation: Spoofers sometimes misuse real business numbers for scams. This can damage trust in the business itself. STIR/SHAKEN makes it harder for fraudsters to impersonate companies, protecting the brand image.
• Support for Regulatory Compliance: In the US, the FCC requires carriers and providers to implement STIR/SHAKEN. Businesses using compliant services can stay aligned with regulations and avoid risks of non-compliance.

STIR/SHAKEN and 10DLC are both compliance frameworks designed to protect communication networks from fraud, but they apply to different channels. Together, they strengthen trust in business communication.

• Focus: Voice calls
• Purpose: Prevent caller ID spoofing by verifying that the number shown on the recipient’s phone matches the true source of the call.
• Benefit: Stops scammers from impersonating trusted numbers and helps legitimate calls get through without being flagged as spam.

• Focus: Text messaging
• Purpose: Ensure that businesses using 10-digit long codes (10DLC) for SMS register with carriers. This verifies who is sending the texts and prevents spam or fraudulent messaging.
• Benefit: Improves message deliverability and protects customers from robotext scams.

While STIR/SHAKEN secures the voice channel, 10DLC secures the messaging channel. Both frameworks require businesses to use verified numbers, reducing fraud across calls and texts. For companies running outbound campaigns, using both ensures:

• Voice calls are authenticated and trusted.
• SMS messages are verified and delivered without being filtered as spam.
• Customers feel safer engaging with both calls and texts from your business.

Yes. In the United States, STIR/SHAKEN is a mandatory requirement for voice service providers under regulations issued by the FCC. This framework was introduced as part of the TRACED Act, which aimed to stop illegal robocalls and restore trust in phone communications. So, what are the FCC requirements?

• All major US carriers and VoIP providers were required to implement STIR/SHAKEN by June 30, 2021.
• Smaller carriers initially received extensions, but those deadlines have now expired, meaning nearly all US providers must comply.
• Providers must also certify their compliance in the FCC’s Robocall Mitigation Database.

While businesses themselves do not directly implement STIR/SHAKEN, the phone service providers they choose must comply. This means companies need to partner with a provider that supports STIR/SHAKEN to make sure their outbound calls are delivered as verified, rather than being flagged as spam. Here are some parties that must comply with the STIR/SHAKEN:

• Large and small carriers
• VoIP service providers
• Resellers and third-party providers
• Any service connecting to the Public Switched Telephone Network (PSTN)

Beyond the United States, other countries are moving toward similar requirements. Canada has already adopted STIR/SHAKEN, making it mandatory for carriers to authenticate caller IDs. European regulators and other regions are exploring adoption as well, though implementation is still at an early stage. Over time, global adoption will create a stronger, unified system for caller ID authentication, protecting both domestic and international communication.

Most carriers require businesses making high volumes of calls to register their numbers. In the US, this includes the FCC’s Free Caller Registry and carrier-specific databases. Registration proves your business is legitimate and helps you achieve A-level attestation.

Always display your business name or a verified number that customers recognize. Avoid using “neighbor spoofing” techniques (fake local numbers) as these are more likely to be flagged and can harm your reputation.

Sudden spikes in outbound call activity often look suspicious and may cause calls to be marked as spam. Ramp up call campaigns gradually and keep volumes steady to maintain a good reputation.

Compliance with the Telephone Consumer Protection Act (TCPA) is essential. Always honor Do Not Call lists, get consent before calling or texting, and provide clear opt-out options. This keeps your business legally safe and improves trust with customers.

Remove disconnected or inactive numbers from your lists. Low answer rates and frequent failed call attempts are signals that can damage your caller's reputation. Using accurate, up-to-date lists reduces the chance of being flagged.

STIR/SHAKEN is an essential framework for protecting voice communication. By authenticating caller ID information, it stops spoofed calls, reduces fraud, and helps rebuild trust in answering phone calls.

For businesses, the impact goes beyond regulatory compliance. Verified numbers mean more calls are answered, customers feel safer, and brands are protected from being misused by scammers. As adoption expands worldwide, STIR/SHAKEN is becoming the foundation of secure and reliable calling.