How Does STIR/SHAKEN Work: Can It Really Stop Robocalls?

You may have noticed calls appearing on your phone as “Verified,” accompanied by a check mark, or otherwise identified as having a validated caller ID. Behind many of those indicators is a technology known as STIR/SHAKEN.

The framework was introduced to make it harder for scammers to disguise their identities using caller ID spoofing—a common tactic in which a caller falsifies the number displayed to the recipient. The Federal Communications Commission (FCC) requires covered voice service providers to implement STIR/SHAKEN on the IP portions of their networks as part of broader efforts to combat illegal robocalls.

But there is an important distinction businesses should understand:

STIR/SHAKEN authenticates information about a call. It does not prove that the person—or system—making that call is trustworthy.

So, how does STIR/SHAKEN actually work, and why can businesses still receive robocalls even when caller authentication is in place?

STIR/SHAKEN is a caller ID authentication framework developed to combat illegally spoofed calls. The name combines two sets of technical standards:

• STIR stands for Secure Telephone Identity Revisited.
• SHAKEN stands for Signature-based Handling of Asserted information using toKENs.

In simple terms, the framework allows telephone providers to attach and verify cryptographic information about calls traveling over IP networks. The originating provider digitally signs information associated with the call, and the receiving provider can verify that signature.

Think of it less like a security guard deciding who is allowed into a building and more like a system for checking credentials.

STIR/SHAKEN can help establish confidence that the caller ID information has not simply been fabricated somewhere along the call path. It does not listen to the caller, determine their intentions, or establish whether a human is actually on the other end.

That difference becomes important when we talk about robocalls.

When a call originates on a participating IP network, the originating provider evaluates what it knows about the caller and their authorization to use the calling number.

Information associated with the call is then digitally signed and carried through the network using a PASSporT token. The terminating provider can validate the signature and authentication information before completing the call.

STIR/SHAKEN uses three primary attestation levels:

A — Full Attestation

The provider knows the customer, knows that the customer originated the call on its network, and has established an association between that customer and the phone number being used.

B — Partial Attestation

The provider knows the customer originating the call but cannot fully verify their right to use the specific caller ID number.

C — Gateway Attestation

The provider can identify where the call entered its network but does not have a direct relationship with the original caller—for example, in certain calls entering through gateways.

These levels do not amount to a rating of whether someone is “good” or “bad.” They indicate how much the signing provider can attest to about the origin of the call and the number being presented.

Caller ID was never originally designed to function as a strong identity-verification system.

That weakness allowed scammers to manipulate caller ID information to make fraudulent calls appear to come from local businesses, government agencies, banks, healthcare organizations, or even numbers belonging to people the recipient knows.

This practice—caller ID spoofing—makes social engineering more convincing because people are naturally more likely to answer or trust a familiar-looking number.

STIR/SHAKEN adds authentication to the calling ecosystem. The FCC says it helps providers verify caller ID information and gives them additional information that can be used to protect subscribers from unwanted and illegally spoofed calls.

That makes STIR/SHAKEN an important layer of defense. But a layer is not the same thing as a complete solution.

Not by itself. This is perhaps the biggest misconception surrounding the technology.

STIR/SHAKEN was designed primarily to authenticate caller ID information, not determine whether every incoming call is legitimate. The FCC’s own assessment has emphasized this distinction, noting that the framework is effective for caller ID authentication while recognizing that it is only one of several tools needed to address illegal robocalls.

Imagine a legitimate business using an automated system to call customers from a telephone number it is genuinely authorized to use. Authentication of that number doesn’t make the call human.

Likewise, a malicious actor could potentially place unwanted calls using numbers obtained or used in ways that do not depend on traditional caller ID spoofing.

That creates an important gap:

Caller authentication asks, “Can we trust the caller ID information?”

Robocall screening asks, “Is there actually a human caller capable of responding on the other end?”

For businesses receiving large volumes of unwanted automated traffic, those are two different problems.

For an organization, robocalls are more than an annoyance. Employees may have to stop what they are doing, check an incoming call, answer it, recognize that it is automated spam, disconnect, and then return to their work. Multiplied across employees and repeated calls, those interruptions can create unnecessary communication friction.

Businesses therefore benefit from multiple layers of call protection. Network technologies such as STIR/SHAKEN help address caller ID authenticity. A business-level robocall screening solution can tackle a different question: whether the incoming caller demonstrates human interaction.

This is where Callegra Robocall Blocker for Business takes a different approach.

When an incoming call is screened, the caller is given a simple instruction to press a specified number. A human caller who understands the request can respond appropriately and proceed. An automated bot that cannot understand and perform the requested action fails the screening.

The system is therefore not trying to decide whether a displayed caller ID “looks suspicious.” It is testing whether the caller can respond to a human-directed command.

The question businesses should ask isn’t necessarily whether STIR/SHAKEN or robocall screening is better. They solve different parts of the problem.

STIR/SHAKEN has made caller authentication an important part of the fight against illegal spoofing. But unwanted automated callers continue to evolve—which means businesses should avoid relying on a single signal when protecting their phone systems.

No. STIR/SHAKEN primarily authenticates caller ID information. Providers and other systems can use authentication information alongside analytics and mitigation techniques, but authentication itself does not guarantee that a call will be blocked.

Not necessarily. Authentication can increase confidence in information about the number associated with a call, but it does not establish the caller’s intentions or guarantee that the call is wanted.

They represent different levels of what the originating provider knows about the caller and their relationship to the calling number. A-level attestation provides the highest level of attestation within the framework, while B and C indicate more limited knowledge.

STIR/SHAKEN makes illegal caller ID spoofing more difficult, but it cannot prevent every form of unwanted or fraudulent calling. A malicious or unwanted caller may, for example, use a legitimately obtained number rather than falsifying caller ID information.

STIR/SHAKEN was developed for IP-based voice networks. The FCC’s implementation requirements and ongoing work have addressed the challenges of caller ID authentication when calls involve non-IP portions of the telephone network.

STIR/SHAKEN is an essential defense against caller ID spoofing, but authentication alone cannot distinguish between a human and an automated bot. A layered approach combining network authentication with smart human-response screening—such as Callegra Robocall Blocker for Business—ensures your organization stays protected.

Ready to eliminate unwanted automated calls without replacing your phone system? Schedule a free consultation today to learn how to add an extra layer of protection to your business communications.