Skip to main content
November 3, 2026 · By Piyush Sahoo STIR/SHAKEN is a caller ID authentication framework for IP phone networks. The originating carrier signs the calling number with a digital certificate and grades its confidence as A, B, or C. The receiving carrier verifies that signature. The result shows whether a number was vouched for, not whether the caller is honest. This guide follows one signed call hop by hop, then shows where signatures get lost and how to read a failure. It also explains why an A rating can still front a scam, and how India’s approach differs. Each outside fact links to the document it came from.
Key takeaways
  • STIR/SHAKEN signs a claim about a number. It doesn’t block calls, and it doesn’t judge intent.
  • A, B, and C describe what the provider knows about the customer and the number. They don’t rate the call’s quality.
  • Signatures need an IP path. A TDM hop, a stripped header, or a forwarded call can leave nothing valid to check.
  • Coverage is partial. One large US sample shows about 54.5% of calls arriving signed in September 2026.
  • India takes a different route. It blocks spoofed international calls and now requires caller name display on 4G and newer networks.

​
Why does caller ID need signing at all?

On the phone network, the calling number is a statement made by whichever network starts the call. Later networks have historically had no signature or certificate to test it against. That was tolerable when few companies could originate calls. IP telephony changed the economics. Once anyone can buy origination capacity, the calling number can become just a setting. STIR/SHAKEN gives the receiving side a way to check who vouched for it. The name covers three separate layers:

​
How does a signed call travel from caller to phone?

Ladder diagram. A certificate system of Governance Authority, Policy Administrator, and Certification Authority supplies the originating provider with a certificate. Your app sends an INVITE to the originating provider, which grades the call and signs a PASSporT. The INVITE with its Identity header passes through a transit provider to the terminating provider, which fetches the certificate and checks the signature, time, and numbers. The call and result then reach analytics, which ring, label, or block. Ladder diagram. A certificate system of Governance Authority, Policy Administrator, and Certification Authority supplies the originating provider with a certificate. Your app sends an INVITE to the originating provider, which grades the call and signs a PASSporT. The INVITE with its Identity header passes through a transit provider to the terminating provider, which fetches the certificate and checks the signature, time, and numbers. The call and result then reach analytics, which ring, label, or block.
  1. Before any call, the provider uses an SPC token to obtain a certificate. Certificates expire, so the provider revalidates its authorization periodically.
  2. At call setup, your system sends a SIP INVITE carrying the number you want to present.
  3. The originating provider signs. It decides the attestation level, builds a PASSporT, and places it in the Identity header.
  4. Transit providers forward it. The header is expected to pass through unchanged, though some session border controllers drop headers they don’t recognise.
  5. The terminating provider verifies. It fetches the signer’s certificate and compares the signed values with the actual INVITE.
  6. Policy takes over. Verification produces a result, and what happens next is a separate decision. Verizon, for example, says it doesn’t block on this data alone and feeds it into call analytics.
Each signed value has a job. The table below uses the claim names from RFC 8588’s SHAKEN example, and RFC 8224 explains how these checks limit cut-and-paste attacks.

​
What do A, B, and C attestation mean?

An attestation is the provider’s statement about its own knowledge. The FCC’s May 2026 notice summarises the ATIS criteria, and you can read them as three questions. Decision map. If the provider has no relationship with whoever originated the call, it must use C, gateway. If it is not putting the call onto the IP network with a direct, identifiable customer, the standards also permit C. If it knows the customer but has not verified the link to the number, it uses B, partial. If all three hold, it can use A, full, which claims knowledge that the number is not spoofed. Decision map. If the provider has no relationship with whoever originated the call, it must use C, gateway. If it is not putting the call onto the IP network with a direct, identifiable customer, the standards also permit C. If it knows the customer but has not verified the link to the number, it uses B, partial. If all three hold, it can use A, full, which claims knowledge that the number is not spoofed. Your setup shapes the grade more than your traffic does: Multi-carrier routing creates a trap here. ECG calls it an attestation gap: the same number can show A on one route and B or C on another. If attestation matters to you, map your outbound routes before you add a second carrier. Standards work also offers certificate delegation, where a provider grants an enterprise its own signing credential. Ask your provider whether this applies before you plan around it.

​
Does an A rating mean a call is safe?

No. A-level attestation says the provider claims to know the number isn’t spoofed. It says nothing about what the caller wants. Two charts from TransNexus for September 2026. Robocall share: A-attested 1.6 percent, all calls 3.4 percent, B-attested 4.6 percent, C-attested 7.8 percent. Top 10 robocall signers attested 75 percent of their calls A, 5 percent B, and 20 percent C. Two charts from TransNexus for September 2026. Robocall share: A-attested 1.6 percent, all calls 3.4 percent, B-attested 4.6 percent, C-attested 7.8 percent. Top 10 robocall signers attested 75 percent of their calls A, 5 percent B, and 20 percent C. TransNexus’s September 2026 data shows both sides. A-attested traffic had the lowest robocall share. Yet the ten most prolific robocall signers gave A to 75% of their calls. The data comes from hundreds of providers using TransNexus products, so read it as a sample. The FCC’s own notice cites harder cases:
  • Lingo Telecom. The FCC found it gave A-level attestation to 3,978 spoofed robocalls. Those calls used a deepfake voice of then-President Biden.
  • Spoofed brands. The American Bankers Association analysed 12,900 calls that illegally spoofed numbers of 47 large companies. More than half received A or B.
So build on the signal with care. If your voice agent or IVR reads a verified result, treat it as one input to routing or fraud scoring. Don’t let it unlock an account or approve a payment.

​
Where do signatures get lost?

A valid signature needs an intact SIP path, a reachable certificate, and values that still match the call. Four common paths behave differently. Four call paths. All-IP: the header arrives and the signature can be checked. TDM hop: nothing to verify unless the token also travels out of band. Call from another country: a US gateway provider signs C, so the signature is valid but identifies only who handed over the call. Forwarded call: the signed destination no longer matches unless a diversion token is added. Four call paths. All-IP: the header arrives and the signature can be checked. TDM hop: nothing to verify unless the token also travels out of band. Call from another country: a US gateway provider signs C, so the signature is valid but identifies only who handed over the call. Forwarded call: the signed destination no longer matches unless a diversion token is added. When a carrier’s policy rejects a call on these grounds, RFC 8224 defines specific SIP responses. A network may label a call rather than reject it, so you can see a verification result and no error.

​
Who requires STIR/SHAKEN today?

Rules differ by country, and they bind providers rather than the businesses that place calls. This table reflects what we could read on November 3, 2026. The US rules are still moving, and these items are proposals:
  • Non-IP calls. The FCC’s April 2025 notice proposes authentication for non-IP networks, with two years to comply if adopted. We found no final order.
  • Attestation standards. The May 2026 further notice proposes to raise the standards for assigning attestations and to close implementation loopholes. Its full text proposes codifying the A, B, and C levels.
  • Robocall Mitigation Database. The FCC voted on further proposals on July 22, 2026 to tighten filing and keep bad actors out. We found no final order.

​
How does India handle caller ID trust?

India has built its controls around different questions. STIR/SHAKEN asks who vouched for a number. India’s tools ask whether a call from abroad is pretending to be local, whose name sits behind a number, and whether a commercial caller is using the right series. CNAP deserves care, because it’s easy to confuse with STIR/SHAKEN. CNAP looks up a name from the operator’s KYC data. Reports of the circular describe a database query between operators, not a signature that travels with the call. As one report notes, a SIM registered to a relative or a fake ID shows that name. If you run a business line, the same circular lets business and bulk connections show a verified preferred name. The name must be a registered trademark or a GST trade name. Ask your operator how to apply. Cross-border verification may come next. At an ITU roundtable in October 2026, Minister of State Chandra Sekhar Pemmasani welcomed the ITU’s proposal for joint trials and suggested starting on selected international routes. That’s backing for a trial, not a mandate or an adopted standard, so don’t design around it yet.

​
Which checks apply to your calls?

Start with call direction, because that determines which system you depend on. Decision map by call direction. Outbound to the US: use a number your provider has tied to your account, keep those calls on that route, expect gateway treatment if crossing a border, and log attestation and spam flags. Outbound within India: complete KYC, use a number registered to you, use the 140 or 160 series for commercial calls, ask about a CNAP preferred name, and expect attestation fields to read Not Applicable. Inbound to your app: read the verification result, treat it as one input, never use caller ID alone to unlock an account or payment, and step up with an OTP or knowledge check. Decision map by call direction. Outbound to the US: use a number your provider has tied to your account, keep those calls on that route, expect gateway treatment if crossing a border, and log attestation and spam flags. Outbound within India: complete KYC, use a number registered to you, use the 140 or 160 series for commercial calls, ask about a CNAP preferred name, and expect attestation fields to read Not Applicable. Inbound to your app: read the verification result, treat it as one input, never use caller ID alone to unlock an account or payment, and step up with an OTP or knowledge check. Signing also isn’t the same as display. Rich Call Data extends PASSporT with signed caller details such as a name. Our caller ID and CNAM guide covers how names reach the screen today.

​
How Vobiz reports STIR/SHAKEN on your calls

Vobiz exposes attestation data on calls, so you can log it alongside your other call data.
  • Live calls. Retrieve a live call to read stir_attestation and stir_verification. Either can return Not Applicable.
  • Call records. The Call object documents stir_verification: Verified (attestation A), Not Verified (B or C), or Not Applicable, for example on non-US calls. On outbound calls it reflects the attestation Vobiz assigned, and on inbound calls the one received.
  • Webhooks (callbacks). Make Call documents STIRAttestation and STIRVerification in its callback parameters. Dial events may also carry STIRVerification on applicable calls.
  • Caller ID. The from value must be a number on your account, and VobizXML callerId on Dial should be an owned or authorized Vobiz number.
  • Rejections. Hangup cause 3130 marks a carrier spam block, and 3140 marks a caller ID on a Do Not Originate list.
  • Number health. Number health returns a spam flag and answer metrics for a Vobiz number over time.
  • India. Calling regulations cover KYC and caller ID rules, and 140 and 160 series acquisition covers commercial numbers.
  • Your own carrier. With Bring Your Own Carrier, your numbers stay with your existing provider, so raise signing questions with that provider too.
Test calls place real calls and are billed to your account. Run them with your own Auth ID and Auth Token, and confirm the numbers first.

​
Frequently asked questions

STIR means Secure Telephone Identity Revisited, a set of IETF standards for signing call identity. SHAKEN means Signature-based Handling of Asserted information using toKENs, the ATIS and SIP Forum profile that tells carriers how to deploy STIR. People use the combined name for the whole framework.
No, not by itself. It gives the receiving network a signed claim about the calling number, and that network then decides what to do. It makes spoofing a number harder and helps tracing. A robocaller using a number it legitimately holds can still pass verification.
They grade what the signing provider knows. A means it knows the customer and has verified that customer’s link to the number. B means it knows the customer but not the link to the number. C means it has no such knowledge, as at an international gateway.
You can’t set it yourself, because your provider assigns the level. Use a number that provider has tied to your account, place the call through that provider, and keep your customer records current. Then check the attestation value it reports on your calls.
In the US, FCC rules require voice providers to implement it in their IP networks unless an exemption applies. Canada also requires it, and France requires a mechanism built on it. The UK’s Ofcom decided in February 2024 not to proceed at that time. The obligation falls on providers, not on the businesses making calls.
We found no TRAI or DoT rule requiring it as of November 3, 2026. India relies on blocking spoofed international calls, CNAP name display on 4G and newer networks, and registered commercial number series. India has also backed ITU trials of cross-border caller verification.

​
Further reading on Vobiz

​
Sources

Standards Regulators India reporting Industry

Build calls on Vobiz

Set up a phone number and place your first call.