TL;DR
Quick Answer
TL;DR
Key Facts
- Caller ID authentication: STIR/SHAKEN uses cryptographic signatures to authenticate caller ID information associated with a call.
- Traceback support: Authentication helps identify which provider signed a call and improves enforcement and traceback efforts.
- Provider accountability: Originating providers determine attestation levels and are responsible for authenticating calls before they enter the network.
- Spoofing can occur before signing: STIR/SHAKEN cannot independently verify whether information supplied to an originating provider is accurate.
- Authentication relies on provider diligence: Improper verification or incorrect attestation decisions can undermine trust in authenticated calls.
- Not all illegal calls are spoofed: Authentication addresses caller ID integrity but does not evaluate call intent or legality.
- Risk reduction, not elimination: STIR/SHAKEN makes spoofing more difficult and more traceable, but it does not completely eliminate illegally spoofed calls
- Authentication limitations: STIR/SHAKEN verifies caller ID information but does not independently validate every caller's legitimacy.
Does STIR/SHAKEN Stop Illegally Spoofed Calls?
No. STIR/SHAKEN helps reduce illegal caller ID spoofing, but it does not completely prevent it.
STIR/SHAKEN was designed to authenticate caller ID information and help providers determine whether a calling number has been legitimately authorized. By creating a verifiable record of which provider authenticated a call, the framework makes spoofed traffic easier to trace and investigate.
However, STIR/SHAKEN relies on the originating provider to verify the caller and assign an appropriate attestation level. If inaccurate information is presented during onboarding, if number authorization is not properly validated, or if authentication controls are insufficient, spoofed calls can still enter the network.
The result is a framework that significantly improves accountability and transparency but does not eliminate illegal spoofing entirely.
How It Works
How Does STIR/SHAKEN Reduce Spoofing?
When a call originates, the originating service provider authenticates caller information and applies a digital signature to the call. That authentication information travels with the call and can be verified by downstream providers before the call reaches the recipient.
This process helps establish:
- Which provider originated and authenticated the call
- Whether the caller ID information can be verified
- The provider's confidence in the caller's authorization to use the number
- A traceable chain of responsibility across the network
Because the signing provider can be identified, traceback investigations become more effective and enforcement actions become easier to support.
Spoofed Calls Can Still Reach Consumers
STIR/SHAKEN authenticates information that is provided to the originating provider. It does not independently investigate every caller or verify every business relationship.
A spoofed call may still be authenticated if:
- The provider receives inaccurate identity information
- Number authorization is incorrectly validated
- Attestation is assigned improperly
- The provider lacks sufficient visibility into the caller's true identity
These limitations are one reason the FCC has increasingly focused on broader caller identity initiatives, including Know Your Customer (KYC) and Know Your Upstream Provider (KYUP), which seek to strengthen identity accountability beyond caller authentication alone.
Authentication Doesn't Prove a Call Is Legitimate
Authentication establishes that caller ID information can be verified and that a provider has confidence in the caller's authorization to use a telephone number. It does not determine:
- Whether the caller is acting lawfully
- Whether the recipient wants the call
- Whether the caller has a positive reputation
- Whether the call is a scam
Those questions are outside the scope of STIR/SHAKEN and are addressed through other controls, including identity verification, enforcement, analytics, and reputation systems.
Why This Matters
Why STIR/SHAKEN Is Still Important
Even though STIR/SHAKEN does not eliminate spoofing, it represents one of the most significant improvements to caller ID trust in decades.
Prior to caller authentication, it was often difficult to identify which provider enabled a spoofed call. STIR/SHAKEN creates a framework for validating caller ID information and tracing calls back to the provider that authenticated them. This improves transparency, accountability, and enforcement capabilities.
Authentication Isn't Enough by Itself
A common misconception is that eliminating spoofing automatically eliminates fraudulent calls.
In reality, authentication addresses only one part of the problem. The FCC's recent caller identity, KYC, and KYUP initiatives reflect a broader regulatory effort to identify not only which number is being used, but also which entities are responsible for the traffic moving through the network.
Fraud prevention increasingly depends on multiple layers of accountability, including:
- Caller authentication
- Customer identity verification
- Upstream-provider due diligence
- Traceback efforts
- Reputation monitoring
- Enforcement actions
What Should Businesses Take Away?
Businesses should view STIR/SHAKEN as an important layer of communications trust, not as a guarantee against spoofing, fraud, or spam labeling.
Organizations benefit most when authentication is paired with strong identity verification, number authorization controls, and reputation management practices. Together, these measures help reduce risk and improve confidence in business communications.
Common Questions
Can a spoofed call receive STIR/SHAKEN authentication?
Potentially. STIR/SHAKEN authenticates information supplied by the originating provider. If inaccurate information is accepted or an attestation decision is made incorrectly, a problematic call may still be authenticated. This is one reason regulators continue to focus on stronger identity verification and provider accountability.
Does A-Level Attestation mean a call is not spoofed?
Not necessarily. A-Level Attestation indicates that the originating provider has a high degree of confidence that the caller is authorized to use the number. It does not independently verify the legitimacy of the caller or guarantee that fraud is not occurring.
Is STIR/SHAKEN effective against illegal robocalls?
It can help reduce certain types of illegal robocalls, particularly those that rely on caller ID spoofing. However, many illegal calls originate from legitimately assigned numbers, which means caller authentication alone cannot stop all robocall activity.
What is the difference between spoofing prevention and call authentication?
Call authentication validates caller ID information and number authorization. Spoofing prevention is a broader goal that may also involve customer verification, provider due diligence, numbering policies, traceback programs, and enforcement actions. STIR/SHAKEN contributes to spoofing prevention, but it is only one component of a larger trust framework.
If STIR/SHAKEN doesn't stop all spoofing, why is it valuable?
STIR/SHAKEN makes spoofing more traceable and increases accountability throughout the voice ecosystem. Even when spoofing attempts occur, authenticated call information helps carriers and regulators identify the providers involved and support investigations that were much more difficult under legacy caller ID systems.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
