What Is STIR/SHAKEN? How Carriers Sign Caller ID

STIR/SHAKEN is a caller ID authentication framework for IP phone networks. The originating carrier signs the calling number with a digital certificate and grades its confidence as A, B, or C. The receiving carrier verifies that signature.

The result shows whether a number was vouched for, not whether the caller is honest. This guide follows one signed call hop by hop, then shows where signatures get lost and how to read a failure. It also explains why an A rating can still front a scam, and how countries without it approach caller ID trust.

Each outside fact links to the document it came from.

Note: Key takeaways

• STIR/SHAKEN signs a claim about a number. It doesn't block calls, and it doesn't judge intent.
• A, B, and C describe what the provider knows about the customer and the number. They don't rate the call's quality.
• Signatures need an IP path. A TDM hop, a stripped header, or a forwarded call can leave nothing valid to check.
• Coverage is partial. One large US sample shows about 54.5% of calls arriving signed in September 2026.
• Some countries take a different route. India, for example, blocks spoofed international calls and now requires caller name display on 4G and newer networks.

Why does caller ID need signing at all?

On the phone network, the calling number is a statement made by whichever network starts the call. Later networks have historically had no signature or certificate to test it against.

That was tolerable when few companies could originate calls. IP telephony changed the economics. Once anyone can buy origination capacity, the calling number can become just a setting.

STIR/SHAKEN gives the receiving side a way to check who vouched for it. The name covers three separate layers:

How does a signed call travel from caller to phone?

Before any call, the provider uses an SPC token to obtain a certificate. Certificates expire, so the provider revalidates its authorization periodically.

At call setup, your system sends a SIP INVITE carrying the number you want to present. The originating provider signs. It decides the attestation level, builds a PASSporT, and places it in the Identity header.

Transit providers forward it. The header is expected to pass through unchanged, though some session border controllers drop headers they don't recognise.

The terminating provider verifies. It fetches the signer's certificate and compares the signed values with the actual INVITE.

Policy takes over. Verification produces a result, and what happens next is a separate decision. Verizon, for example, says it doesn't block on this data alone and feeds it into call analytics.

Each signed value has a job. The table below uses the claim names from RFC 8588's SHAKEN example, and RFC 8224 explains how these checks limit cut-and-paste attacks.

What do A, B, and C attestation mean?

An attestation is the provider's statement about its own knowledge. The FCC's May 2026 notice summarises the ATIS criteria, and you can read them as three questions. Your setup shapes the grade more than your traffic does:

• Your app places calls through the provider that assigned the number - A is possible. The provider can satisfy all three criteria.
• Your PBX presents a number hosted at another carrier - B or C. The provider knows you but may lack proof of the number.
• The call reaches a US provider from a foreign network - C. A gateway provider has no relationship with the originator.

Multi-carrier routing creates a trap here. ECG calls it an attestation gap: the same number can show A on one route and B or C on another. If attestation matters to you, map your outbound routes before you add a second carrier.

Standards work also offers certificate delegation, where a provider grants an enterprise its own signing credential. Ask your provider whether this applies before you plan around it.

Does an A rating mean a call is safe?

No. A-level attestation says the provider claims to know the number isn't spoofed. It says nothing about what the caller wants.

TransNexus's September 2026 data shows both sides. A-attested traffic had the lowest robocall share. Yet the ten most prolific robocall signers gave A to 75% of their calls. The data comes from hundreds of providers using TransNexus products, so read it as a sample.

The FCC's own notice cites harder cases:

• Lingo Telecom. The FCC found it gave A-level attestation to 3,978 spoofed robocalls. Those calls used a deepfake voice of then-President Biden.
• Spoofed brands. The American Bankers Association analysed 12,900 calls that illegally spoofed numbers of 47 large companies. More than half received A or B.

So build on the signal with care. If your voice agent or IVR reads a verified result, treat it as one input to routing or fraud scoring. Don't let it unlock an account or approve a payment.

Where do signatures get lost?

A valid signature needs an intact SIP path, a reachable certificate, and values that still match the call. Four common paths behave differently.

TDM segments. The FCC says the fingerprint is washed off when any part of the path is non-IP. RFC 8816 defines an out-of-band way to deliver PASSporTs around such hops.

Borders. Overseas operators don't have to follow another country's verification rules. Ofcom named this gap when it weighed gateway attestation for calls from overseas.

Forwarding. The original token names the original destination. RFC 8946 adds a diversion PASSporT that explains the change to verifiers.

When a carrier's policy rejects a call on these grounds, RFC 8224 defines specific SIP responses. A network may label a call rather than reject it, so you can see a verification result and no error.

Who requires STIR/SHAKEN today?

Rules differ by country, and they bind providers rather than the businesses that place calls. This table reflects what we could read on November 3, 2026.

The US rules are still moving, and these items are proposals:

• Non-IP calls. The FCC's April 2025 notice proposes authentication for non-IP networks, with two years to comply if adopted. We found no final order.
• Attestation standards. The May 2026 further notice proposes to raise the standards for assigning attestations and to close implementation loopholes. Its full text proposes codifying the A, B, and C levels.
• Robocall Mitigation Database. The FCC voted on further proposals on July 22, 2026 to tighten filing and keep bad actors out. We found no final order.

How do other countries handle caller ID trust?

Some countries build caller ID trust around different questions. STIR/SHAKEN asks who vouched for a number. Other controls ask whether a call from abroad is pretending to be local, whose name sits behind a number, and whether a commercial caller is using the right number range.

India is a clear example. It launched a system in October 2024 that blocks calls from abroad showing Indian numbers, labels calls from abroad as "International Call", and from November 1, 2026 shows a name from the operator's KYC record on 4G and newer networks. Commercial calls must use the 140 and 160 series, covered in the Vobiz calling regulations and the UCC guide.

That name lookup is a database query between operators, not a signature that travels with the call, so a SIM registered to a relative or a fake ID shows that name.

Cross-border verification may come next. At an ITU roundtable in October 2026, India's Minister of State Chandra Sekhar Pemmasani welcomed the ITU's proposal for joint trials. That's backing for a trial, not a mandate or an adopted standard, so don't design around it yet.

Which checks apply to your calls?

Start with call direction, because that determines which system you depend on. Signing also isn't the same as display. Rich Call Data extends PASSporT with signed caller details such as a name. Our caller ID and CNAM guide covers how names reach the screen today.

STIR/SHAKEN in the Vobiz docs. How attestation shows up in your call data is covered in the docs for the Call object, Make Call, and hangup causes. For India, see the calling regulations.

Frequently asked questions

What does STIR/SHAKEN stand for?

STIR means Secure Telephone Identity Revisited, a set of IETF standards for signing call identity. SHAKEN means Signature-based Handling of Asserted information using toKENs, the ATIS and SIP Forum profile that tells carriers how to deploy STIR. People use the combined name for the whole framework.

Does STIR/SHAKEN stop robocalls?

No, not by itself. It gives the receiving network a signed claim about the calling number, and that network then decides what to do. It makes spoofing a number harder and helps tracing. A robocaller using a number it legitimately holds can still pass verification.

What are A, B, and C attestation?

They grade what the signing provider knows. A means it knows the customer and has verified that customer's link to the number. B means it knows the customer but not the link to the number. C means it has no such knowledge, as at an international gateway.

How do I get A-level attestation?

You can't set it yourself, because your provider assigns the level. Use a number that provider has tied to your account, place the call through that provider, and keep your customer records current. Then check the attestation value it reports on your calls.

Is STIR/SHAKEN mandatory?

In the US, FCC rules require voice providers to implement it in their IP networks unless an exemption applies. Canada also requires it, and France requires a mechanism built on it. The UK's Ofcom decided in February 2024 not to proceed at that time. The obligation falls on providers, not on the businesses making calls.

Is STIR/SHAKEN used outside the US?

In some countries. Canada and France use it, while the UK decided not to proceed in 2024. In India, we found no TRAI or DoT rule requiring it as of November 3, 2026, and the country relies on blocking spoofed international calls, CNAP name display on 4G and newer networks, and registered commercial number series. India has also backed ITU trials of cross-border caller verification.

Further reading on Vobiz

What is caller ID and CNAM? · What is SIP trunking? Call object · Hangup causes India calling regulations · Voice calls overview

Sources

Standards

• IETF, RFC 8224: Authenticated Identity Management in SIP, February 2018.
• IETF, RFC 8225: PASSporT, February 2018.
• IETF, RFC 8226: Secure Telephone Identity Credentials, February 2018.
• IETF, RFC 8588: PASSporT Extension for SHAKEN, May 2019.
• IETF, RFC 8816: STIR Out-of-Band Architecture and Use Cases, February 2021.
• IETF, RFC 8946: PASSporT Extension for Diverted Calls, February 2021.
• IETF, RFC 9060: STIR Certificate Delegation, September 2021.
• IETF, RFC 9795: PASSporT Extension for Rich Call Data, July 2025.

Regulators

• FCC, Further Notice of Proposed Rulemaking, FCC 26-32, adopted May 20, 2026.
• FCC, News release on Know-Your-Upstream-Provider and STIR/SHAKEN proposals, May 20, 2026.
• FCC, News release on Robocall Mitigation Database proposals, July 22, 2026.
• FCC, News release on the non-IP caller ID proposal, April 28, 2025.
• Ofcom, CLI authentication: assessment and future roadmap, February 1, 2024.
• Arcep, Authentification des numéros : que faire en tant qu'opérateur téléphonique, in French, updated March 27, 2026.

India reporting

• ThePrint, Govt makes caller name display mandatory from 1 November, October 2026.
• IBTimes India, Unknown callers to display names from Novem