Understanding STIR/SHAKEN Compliance for Secure VoIP and Telecom Calls

Robocalls and caller ID spoofing have become a serious problem for consumers and businesses alike. To address this, the FCC mandated the STIR/SHAKEN framework, a system that helps verify the authenticity of caller ID information. But what does STIR/SHAKEN actually mean, and why does it matter for your telecom or VoIP business?

What Is STIR/SHAKEN?

STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) are protocols used together to validate a caller’s identity on IP-based phone networks. The goal is to prevent spoofing by allowing phone providers to digitally sign and verify caller ID information as a call travels through the network.

Think of it like an SSL certificate for phone calls: when a call is made, a digital signature is attached by the originating carrier. Each carrier in the call path verifies the signature before passing it along. If the final provider confirms the signature, the recipient sees that the call is “verified” (often marked by a green check or “Caller Verified” message).

Who Needs To Be STIR/SHAKEN Compliant?

All voice service providers operating over IP networks in the U.S. are required to implement STIR/SHAKEN. This includes:

• Telecom carriers
• VoIP providers and resellers
• Call centers using outbound phone systems
• Enterprises running PBX systems interconnected to public networks

Providers using non-IP networks (like TDM) must either upgrade or implement a robocall mitigation plan registered with the FCC.

How STIR/SHAKEN Works Technically

The process relies on public key infrastructure (PKI). Here’s the simplified flow:

1. A call originates from a device, and the service provider checks if they can verify the caller’s identity.
2. If verified, they generate a SIP Identity Header with a digital signature and attach it to the call.
3. Intermediate carriers forward the call with the header untouched.
4. The terminating carrier verifies the header using public keys hosted in a certificate repository.
5. If verification succeeds, the receiver is informed the call is verified.

Attestation Levels

STIR/SHAKEN defines three levels of trust, called attestation levels:

• Full Attestation (A): The provider knows the customer and can confirm they are authorized to use the number.
• Partial Attestation (B): The provider knows the customer but not the number’s origin.
• Gateway Attestation (C): The provider is simply passing along a call with no verification of the source.

Certificates and Governance

To participate in STIR/SHAKEN, providers must acquire a certificate from a Certification Authority (CA) authorized by the Secure Telephone Identity Governance Authority (STI-GA). They also need to register with the Secure Telephone Identity Policy Administrator (STI-PA).

Important links:

• FCC Call Authentication Overview
• STI-GA Official Site
• STI-PA Official Site
• How STIR/SHAKEN Works – TransNexus Guide

Benefits of Compliance

For telecom and VoIP providers, STIR/SHAKEN compliance is more than a regulatory requirement—it helps build trust with customers. Verified calls are more likely to be answered, reducing the impact of blocked calls and spam filtering. It also positions your organization as a legitimate and secure provider in a crowded marketplace.

Implementation Timeline

The original FCC deadline for large voice providers was June 30, 2021. Smaller providers were granted extensions through June 30, 2023, though this has since been shortened due to ongoing spoofing concerns. All IP-based carriers must now be compliant unless exempted for specific reasons.

How To Check If You’re Compliant

You can verify your STIR/SHAKEN status in a few ways:

• Check your FCC robocall mitigation database registration: FCC Robocall Mitigation Portal
• Request a compliance review from your VoIP vendor or carrier
• Use test numbers or third-party tools that analyze SIP headers to confirm call signatures

Looking Ahead

STIR/SHAKEN is just the beginning. As the FCC expands its scope, additional frameworks may be introduced to address new spoofing tactics. Staying ahead means monitoring rule changes, keeping your infrastructure up to date, and working with partners who prioritize security and transparency.