If your outbound calls have started showing up as "Spam Likely" or "Scam Risk" on your customers' phones, you are not being singled out — you are running into STIR/SHAKEN, the call authentication framework that every US voice provider has been required to implement since June 2021. The framework works well at what it was designed to do, which is making caller ID spoofing expensive and traceable. But it also penalises legitimate businesses that have not configured their outbound calling correctly. This article explains what the framework actually does, why well-behaved businesses get caught by it, and exactly what to fix.
The Problem STIR/SHAKEN Was Built to Solve
The original SIP and SS7 signalling standards were designed in an era when only licensed carriers could originate calls, so they simply trusted whatever caller ID a call carried. When VoIP made call origination cheap and universal, that trust assumption collapsed. Any originator could put any number in the From header, which is what makes neighbour spoofing — calls that appear to come from a number matching your own area code and prefix — possible at industrial scale.
Robocall volumes peaked at roughly 58 billion calls per year in the US, and the overwhelming majority relied on spoofed caller ID. The TRACED Act of 2019 directed the FCC to require a technical solution, and STIR/SHAKEN is what the industry produced.
What the Acronyms Actually Mean
STIR (Secure Telephone Identity Revisited) is the IETF standard that defines how a cryptographic signature is attached to a SIP call. The originating provider creates a JSON Web Token containing the calling number, called number, timestamp and an attestation level, signs it with a private key, and attaches it to the SIP INVITE in an Identity header.
SHAKEN (Signature-based Handling of Asserted information using toKENs) is the ATIS framework that defines how US carriers deploy STIR in practice — how certificates are issued, who is allowed to sign, and how the terminating provider verifies the signature against the public certificate before deciding what to display.
The Three Attestation Levels — And Why Yours Matters
This is the part that directly determines whether your calls get answered. When your provider signs a call, it asserts one of three levels:
- Attestation A (Full): The provider knows the customer, knows they are authorised to use the calling number, and originated the call itself. This is the level that reaches handsets cleanly and displays verified-caller indicators on carriers that support them.
- Attestation B (Partial): The provider knows the customer but cannot confirm they are entitled to the specific number presented. Calls are delivered, but analytics engines treat them with more suspicion, and repeat patterns can trigger labelling.
- Attestation C (Gateway): The provider passed the call along but cannot vouch for its origin — typical for international gateway traffic. Calls at this level are the most likely to be labelled or blocked outright.
Most businesses that suffer from spam labelling are receiving B or C attestation without realising it. The usual cause is presenting a caller ID that belongs to a different carrier from the one carrying the call.
Why Legitimate Businesses Get Flagged
Three patterns account for the majority of cases we see:
- Unregistered caller ID: You send calls out over one provider while presenting a number that lives with another. Without number ownership verification, full attestation is impossible.
- Missing CNAM registration: Attestation gets your call delivered; the CNAM database is what puts your business name on the screen. Carriers increasingly draw on separate branded-calling registries, and an unregistered number displays as a bare number, which analytics engines score as higher risk.
- Calling patterns that look automated: Analytics engines from Hiya, First Orion and TNS score behaviour as well as attestation — short average call duration, high call volume from a single number, and low answer rates all push a number toward a spam label regardless of its signature.
What to Actually Do About It
The remediation is well-defined and usually takes a few weeks to show results:
- Consolidate origination and numbering with one provider so full A-level attestation is possible on every outbound call. PBX SIP Trunking signs all customer traffic with A attestation where the number is hosted or verified with us.
- Register CNAM for every outbound number so your business name displays rather than a raw number.
- Spread outbound volume across a pool of numbers rather than hammering a single DID, and make sure each number is registered.
- Remediate existing spam labels through the free reporting portals operated by the major analytics providers — labels persist even after the underlying problem is fixed unless you actively request review.
- Monitor answer rates per number so a developing labelling problem is visible before it costs you a quarter of pipeline.
What STIR/SHAKEN Does Not Do
It is worth being precise about the framework's limits. STIR/SHAKEN authenticates that a call originated from a provider entitled to use the number — it does not verify that the call is wanted, legal, or honest. A fully compliant, A-attested call can still be an unwanted telemarketing call. Conversely, the framework has no effect on calls that never touch the IP network end to end. It is one layer of a defence that also includes analytics, consumer reporting and enforcement.
The Bottom Line
Call authentication is not going away, and the labelling engines that sit on top of it are getting more aggressive each year. Businesses that treat outbound caller ID as something to configure once and forget will keep losing answer rates to spam labels. Businesses that register their numbers, consolidate their origination, and monitor per-number answer rates keep their calls looking legitimate — because they are. PBX SIP Trunking includes A-level attestation, CNAM registration and per-number answer rate reporting on every trunk as standard, with no additional compliance fee.