Subscribe
Tags
SIP Trunking
Compliance & Security
Voice AI
Contact Center
Caller ID has not solved all of the industry's spam problems. A robocaller can dial out with any number in the ‘from’ field (a practice known as caller ID spoofing). STIR/SHAKEN is the industry's answer to that gap.
What is caller ID spoofing?
Caller ID spoofing is the practice of deliberately falsifying the caller ID information transmitted with a phone call so the displayed number doesn't belong to the actual caller.
Anyone originating a call over SIP can typically set that field to whatever number they want. That's what makes it possible for a robocaller to show up on a phone looking like a bank, a government agency, or even a neighbor with a similar area code and prefix (sometimes called "neighbor spoofing").
Spoofing itself isn't always malicious. Some legitimate use cases exist, like a business displaying a central support line instead of an individual employee's number. But it's also the mechanism behind most scam and robocall traffic, which is why regulators and carriers built STIR/SHAKEN specifically to address it: not by making spoofing technically impossible, but by giving the receiving carrier a way to know whether the number was verified by the network that originated the call.
What is STIR/SHAKEN?
STIR/SHAKEN is a call authentication framework that lets a receiving carrier verify whether the caller ID on an incoming call was actually confirmed by the carrier that originated it.
STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) work together to attach a cryptographically signed token, called a PASSporT, to a call as it leaves the originating carrier's network.
The token travels in SIP Identity headers. The receiving carrier checks it and decides how much to trust the displayed caller ID, which in turn affects whether the call rings through clean, arrives labeled “Spam Likely” or “Scam Likely,” or gets blocked outright.
STIR/SHAKEN attestation levels
The token carries one of three attestation levels:
Level A (full attestation). The originating carrier authenticated the caller and confirmed the caller is authorized to use that number.
Level B (partial attestation). The carrier authenticated the caller but could not confirm the number is theirs to use.
Level C (gateway attestation). The call entered the carrier's network from an external source with no verified identity at all.
Attestation only exists where a carrier originates the call. A platform that resells someone else's SIP trunk is asking that trunk provider to vouch for its traffic. A platform that owns the origination path can sign for its own calls.
SignalWire's compliance and default STIR/SHAKEN attestation
SignalWire is STIR/SHAKEN compliant. By default, every outbound call placed from a phone number purchased on the SignalWire platform receives level C attestation.
Level A and level B attestation are available, but they require a vetting process. A customer who needs a higher attestation level, for example a call center that wants its outbound numbers to authenticate as fully verified, must open a support ticket to start that process.
How to achieve full STIR/SHAKEN attestation
Request a vetting review to move off the level C default. This is a support-driven process, not a self-service dashboard toggle, since it depends on the provider's knowledge of the customer, the use case, and the specific numbers involved.
Verify caller ID ownership
Before a phone number can be used as the outbound caller ID on a SIP endpoint, the customer proves ownership of it through a call-me-and-enter-code flow (or the equivalent REST API verified_callers resource). This is a separate control from attestation level, but it addresses the same underlying problem: making sure the number displayed on a call is actually controlled by the party placing it.
Neither control replaces the other. Attestation is what the network tells the receiving carrier about trust in the caller ID. Verified Caller IDs is what SignalWire enforces on its own customers before letting them assert a number as their own.
It's also worth remembering that attestation is a network-level signal, not proof of identity inside an application. Don't treat caller ID as sufficient for anything sensitive. A function handler that authorizes an account change based on the incoming caller ID alone is trusting a value that sits upstream of any attestation check. The recommended pattern is a second factor, such as a verification code, before acting on anything consequential.
The open source implementation: libstirshaken
SignalWire didn't just implement STIR/SHAKEN to satisfy the FCC mandate. It sponsored libstirshaken, an open source implementation of the framework built under the FreeSWITCH project, one of the earliest open source implementations of STIR/SHAKEN.
The goal was to put caller verification directly into developers' hands rather than leaving it locked inside proprietary carrier stacks, making it cheaper and simpler to generate the security certificates STIR/SHAKEN depends on.
Get started with outbound calling today
Create a free SignalWire account, purchase your first phone number, and connect with the community and team on Discord.
What's the difference between attestation and caller ID ownership verification?
Attestation is a claim your carrier makes to other carriers about how confident it is in your identity and right to use a number. It's a network-level signal, checked automatically. Caller ID ownership verification is a check your own platform runs on you before letting you use a number as your outbound caller ID in the first place. Verifying ownership doesn't automatically raise your attestation level, and a platform could theoretically attest a call without having verified ownership itself.
Is STIR/SHAKEN the only framework of its kind?
Within the US, yes. It's the FCC-mandated standard for IP-based calls. Globally, other regulators (Canada, France, and others developing similar rules) have adopted their own versions modeled on STIR/SHAKEN rather than building separate systems, which reinforces its position as the reference model rather than one option among several. Its main limitation is scope: it only covers IP-based call signaling (SIP).
What do I do if my calls are being marked as Spam or Scam?
Spam and scam labels aren't stored in one place. They're set independently by mobile carriers, device makers, and reputation providers based on signals including number history, calling patterns, your CNAM record, and your STIR/SHAKEN attestation level. Because multiple systems are involved, fixing a label usually takes more than one step.
Even after correction, calling behavior can re-trigger a label. High call volume on newly assigned numbers, short or abandoned calls, and inconsistent caller ID usage are common culprits. For SignalWire's full step-by-step process, see Resolving Spam Labels.
Is caller ID spoofing the same thing as robocalling?
No. Robocalling refers to placing calls using an automated system rather than a human dialer. Caller ID spoofing refers to falsifying the number displayed to the recipient. The two are independent: a robocall can display a completely accurate number (an automated appointment reminder, for example), and a spoofed call can be placed manually by a human. They're closely associated in practice because illegal robocall operations rely heavily on spoofing to cycle through fake numbers at scale, but the terms aren't interchangeable.
Related Resources
