If your business makes outbound calls and customers are seeing "Spam Likely" on their screens, STIR/SHAKEN is part of the story. It is the framework US carriers use to cryptographically authenticate caller ID on outbound calls — verifying that the number appearing on the recipient's phone belongs to the organization actually placing the call. Understanding how it works, what the three attestation levels mean, and why spam labels appear even on authenticated calls is practical knowledge for any business that depends on people answering their phones.
Definition: STIR/SHAKEN is a pair of complementary standards — STIR (Secure Telephone Identity Revisited, defined in IETF RFC 8224 and RFC 8226) and SHAKEN (Signature-based Handling of Asserted information using toKENs, defined by ATIS and the SIP Forum) — that together create a mechanism for originating carriers to cryptographically sign outbound SIP calls and for terminating carriers to verify those signatures. The goal is to authenticate caller ID information so that spoofed numbers can be identified and flagged before reaching the called party.
Why STIR/SHAKEN Exists
Caller ID was designed with no authentication mechanism. Any organization with access to a SIP trunk or VoIP gateway can transmit any number they like as the calling party — a practice called caller ID spoofing. Robocallers and scammers exploit this constantly, impersonating government agencies, banks, and local businesses to increase answer rates.
STIR/SHAKEN addresses this by creating a chain of trust: the carrier that originates the call signs it with a private cryptographic key, asserting what it knows about the relationship between the calling party and the number being presented. The terminating carrier (the one delivering the call) verifies that signature against a public certificate. If the signature is valid, the call is authenticated. If the signature is missing or invalid, the call is flagged as unverified.
The FCC mandated that all US voice service providers implement STIR/SHAKEN across their IP network infrastructure (FCC Orders FCC 20-42 and FCC 17-151, codified at 47 CFR §64.6300–6306). Providers must also recertify annually in the Robocall Mitigation Database (RMD), a public registry maintained by the FCC. Businesses are not directly regulated by these requirements — your carrier is. But your carrier's compliance and how your account is set up with them directly affects what attestation level your calls receive.
How the Signing Mechanism Works
When your business places an outbound call through a STIR/SHAKEN-capable carrier, the originating carrier creates a PASSporT (Personal Assertion Token) — a JSON Web Token (JWT) containing:
- The calling number (your number)
- The called number (the destination)
- A timestamp of when the call was initiated
- An attestation level (A, B, or C — covered below)
- An origination identifier that traces back to the carrier's certificate
This PASSporT is signed with the originating carrier's private key and embedded in the SIP INVITE message as an Identity header. The call travels over the SIP network to the terminating carrier.
The terminating carrier receives the SIP INVITE, extracts the Identity header, and retrieves the originating carrier's public certificate from a Secure Telephone Identity Certificate Authority (STI-CA). It verifies the signature. If the signature is valid and the certificate is in good standing, the call has passed STIR/SHAKEN verification. The terminating carrier can then pass a verified indicator to downstream analytics systems and, in some cases, to the called party's device.
Calls that travel over traditional TDM/POTS legs at any point in their journey may lose the STIR/SHAKEN signature, since the SIP Identity header has no equivalent in TDM signaling. This is one reason calls can receive lower attestation levels even when the originating carrier is STIR/SHAKEN-capable.
The Three Attestation Levels
The attestation level embedded in the PASSporT token tells the terminating carrier how much the originating carrier can vouch for the calling party. The three levels are distinct and matter practically:
| Level | Name | What the carrier is asserting |
|---|---|---|
| A | Full Attestation | The carrier has verified the caller's identity AND that the caller is authorized to use the specific number being presented. This is the highest level. |
| B | Partial Attestation | The carrier has verified the caller's identity but cannot confirm that the caller has the right to use the specific number presented. Common when a business uses numbers not directly provisioned through their carrier. |
| C | Gateway Attestation | The call entered the IP network at this gateway but the carrier cannot verify the origin or the right to use the number. Typically assigned to calls arriving from external or interconnected networks. |
For a business, the practical goal is A-level attestation. Getting there requires that your numbers are registered and verified with your carrier, that your carrier is STIR/SHAKEN-compliant, and that your numbers are directly associated with your account in the carrier's provisioning system. Numbers acquired from a third party and ported in, or numbers used through a gateway arrangement, may receive B-level attestation even with a compliant carrier.
What STIR/SHAKEN Does Not Do
STIR/SHAKEN authenticates caller ID. It does not evaluate call intent or call content. A robocaller with legitimately provisioned numbers and a compliant carrier can still receive A-level attestation. The framework prevents caller ID spoofing — using a number you do not own — but it does not prevent someone who actually owns a number from using it to make unwanted calls.
This is an important distinction because it explains why spam labels still appear on STIR/SHAKEN-authenticated calls. Spam labeling and STIR/SHAKEN attestation come from different systems.
Spam Labels: A Separate System
The "Spam Likely," "Scam Risk," or "Potential Spam" labels that appear on called parties' phones come from call analytics platforms — not from STIR/SHAKEN itself. These platforms include databases operated by companies like First Orion, Hiya, and TNS, which are integrated into carrier networks and consumer devices.
Spam labels are generated by a combination of:
- Crowd-sourced flagging — consumers who report a number as spam through their device's call-blocking app or carrier interface contribute to a collective database. High report volume for a number raises its spam score.
- Call behavior patterns — high call volume from a number in a short period, high abandonment rates, and calls to many different geographic areas are statistical signals associated with automated dialing campaigns.
- STIR/SHAKEN attestation level — attestation feeds into trust scoring. A-level calls have a higher baseline trust signal; B or C-level calls are treated with more suspicion by analytics platforms, though a low attestation level alone does not trigger a spam label.
- CNAM database status — the Caller Name (CNAM) associated with a number affects how analytics platforms categorize it. Numbers with no CNAM record or mismatched business names raise flags.
The takeaway is that a business can have STIR/SHAKEN A-level attestation and still receive spam labels if its calling behavior — high volume outbound dialing, high abandonment rates, or crowd-sourced consumer complaints — triggers the analytics platforms' scoring models. Conversely, a business with B-level attestation may not be labeled as spam if its call behavior is clean.
Why Business Calls Get Labeled as Spam
Several specific scenarios cause legitimate business calls to receive spam labels:
- High abandoned call rates — a predictive dialer with a poorly calibrated pacing algorithm generates abandoned calls. Each abandoned call from your number is a data point for analytics platforms. For more on abandoned call rates, see how predictive dialers work.
- Shared numbers — using numbers that have been shared with or previously used by other organizations. A number's spam reputation follows it. Numbers with prior spam history will carry that reputation even after being reassigned.
- Low attestation level — B or C-level attestation signals to analytics platforms that the number's authorization has not been fully verified, which raises its spam scoring threshold.
- High outbound call volume concentration — making hundreds of calls per day from a single number in a short window looks like automated dialing to pattern-detection systems, even if every call is placed by a live agent.
- Consumer complaints — if the people being called find the calls unwanted and report them, the number accumulates a spam signal regardless of attestation level or call behavior metrics.
What Businesses Can Do About It
There is no single fix for spam labels, but there are concrete steps that reduce the risk:
- Verify numbers with your carrier — make sure every number your business uses for outbound calling is registered and associated with your account at the carrier level. This is the prerequisite for A-level STIR/SHAKEN attestation.
- Register numbers with call analytics platforms — companies like Hiya, First Orion, and TNS offer business registration portals where you can associate your numbers with your business name. This does not guarantee spam-label immunity but gives analytics platforms verified context for your numbers.
- Monitor your numbers — tools exist to check whether your numbers are labeled across major analytics platforms. Regular monitoring lets you detect problems before they significantly impact answer rates.
- Manage abandonment rates — if you use a predictive dialer, ensure the pacing algorithm is calibrated to keep abandoned call rates within the FTC TSR 3% cap. See predictive dialer compliance for the full regulatory picture.
- Scrub your lists — calling numbers on the DNC registry generates complaints and regulatory risk. For DNC compliance mechanics, see what is the DNC registry.
- Use a STIR/SHAKEN-compliant carrier — choose a voice provider that has implemented STIR/SHAKEN properly, maintains its Robocall Mitigation Database filing, and can provision numbers in a way that supports A-level attestation for your account.
CNAM: A Related but Separate System
CNAM (Caller Name) is the database system that populates the business name displayed alongside a phone number on the called party's screen. STIR/SHAKEN authenticates the number; CNAM provides the associated name. These are completely separate systems.
CNAM updates are managed through your carrier, typically via a CNAM provisioning request. If your business name is not appearing correctly or at all on outbound calls, that is a CNAM issue — not a STIR/SHAKEN issue. Many businesses neglect CNAM provisioning, which results in calls showing only a raw phone number with no associated name, a pattern that analytics platforms and consumers alike associate with unknown callers.
Accurate CNAM provisioning combined with A-level STIR/SHAKEN attestation gives analytics platforms two confirming signals about your identity — which is the strongest starting position for avoiding spam labels.
Practical Example: SMB with High Outbound Volume
Consider a 15-agent insurance sales team running outbound campaigns. They make 800–1,000 calls per day from three outbound numbers, using a predictive dialer with AMD. Their numbers start receiving "Spam Likely" labels after three months, and answer rates drop from 18% to 9%.
Tracing the cause: the dialer's abandoned call rate was running at 5–6% (above the FTC TSR 3% cap), generating consumer complaints. The numbers were also receiving B-level STIR/SHAKEN attestation because one of the three outbound numbers was originally provisioned through a third-party number provider rather than directly through their carrier, so the carrier could not fully verify the business's right to use it.
The path back: migrate that number to direct carrier provisioning to achieve A-level attestation, recalibrate the predictive dialer's pacing algorithm to bring abandonment within compliant limits, register numbers with Hiya and First Orion's business portals, and monitor label status weekly for 60 days. Answer rates typically recover gradually as the spam signal decays — a process that can take four to eight weeks depending on the platform, since crowd-sourced spam signals are not immediately removed when call behavior improves.
