STIR/SHAKEN Explained

STIR/SHAKEN is a framework US voice carriers use to cryptographically sign outbound calls and verify that the calling number is authorized to use the caller ID being presented. STIR (Secure Telephone Identity Revisited) defines the signatures; SHAKEN (Signature-based Handling of Asserted Information Using toKENs) describes how carriers exchange and validate them on IP networks.

The FCC has pushed providers to implement STIR/SHAKEN to reduce illegal caller ID spoofing — especially neighbor spoofing and impersonation of toll-free or government numbers. Think of it as a digital handshake between carriers: the originating network attests how confident it is that the caller owns the number, and the terminating network (your carrier) can pass that signal to your phone.

STIR/SHAKEN is infrastructure, not a consumer app you install. You experience it indirectly through your carrier's call filtering and, on some devices, a label such as "Verified caller" or "Number verified."

When your phone displays a Verified indicator (wording varies by carrier and device), it usually means the call received a full (A-level) attestation — the originating carrier vouches that the caller is authorized to use that number.

• Verified means the caller ID passed authentication checks — not that you know the caller or that the call is safe to answer.
• Partial attestation (B-level) may indicate the call is legitimate but originated from a downstream provider — your phone may not show a Verified badge.
• Gateway attestation (C-level) offers the weakest signal — common on calls that entered the US network from abroad.
• No label does not automatically mean a scam — some legitimate small-business lines still lack full signing.

Treat Verified as one data point, not a guarantee. A verified number can still belong to a bad actor who obtained a real line, and legitimate businesses you trust may call without a badge depending on routing.

STIR/SHAKEN reduces certain types of spoofing but does not eliminate unwanted or fraudulent calls. Important limits include:

• Scammers who use real phone numbers they control — authentication passes because they truly own the line.
• Calls that originate outside STIR/SHAKEN coverage or enter through gateways with weak attestation.
• Robocall campaigns that comply with signing but still violate telemarketing or consent rules.
• Social engineering — a verified caller ID does not stop IRS impersonation if the scammer registered a legitimate number.
• Legacy TDM (non-IP) network segments where signing may be incomplete.

Consumer tools — block lists, carrier filters, community lookup on CheckThatCall, and skepticism toward unsolicited requests — remain essential even as authentication rolls out nationwide.

Fraud operators adapt to authentication the same way they adapted to do-not-call rules. Common patterns include:

• Acquiring batches of real local numbers and rotating through them before carriers suspend service.
• Using compromised business phone systems to place signed outbound calls.
• Relying on callback traps (see our one-ring guide) where the scam profits when you dial out.
• Combining verified-looking caller ID with high-pressure scripts — tax threats, account locks, or prize claims.

That is why CheckThatCallemphasizes community reports and reverse lookup: authentication tells you something about the number's signing status, while aggregated user tags tell you how others experienced calls from that listing. Search a number on the homepage before you trust a unfamiliar Verified badge alone.

For recognition tips beyond caller ID labels, see How to Spot a Robocall.

STIR/SHAKEN does not replace blocking. If a signed or unsigned number keeps calling with pitches you did not consent to receive, block it on your device and consider a carrier complaint at consumercomplaints.fcc.gov.

This article is general educational information, not legal or technical advice. Carrier implementations and on-screen labels vary.CheckThatCall does not operate STIR/SHAKEN infrastructure and does not verify individual reports. See our Disclaimer and About pages for how our lookup data works.