What Callers Need to Know About STIR/SHAKEN

Has your business received a complaint about a call it did not make? You may not be alone. Unfortunately, technological advancements in the telecommunications industry have made it easier and cheaper than ever for callers to “spoof” or falsify caller ID information. The industry no longer consists of a few trusted carriers; instead, a multitude of voice service providers are originating calls. To reduce the effectiveness of illegal spoofing, on January 6, 2020, Congress signed the TRACED Act into law, requiring voice service providers to implement the STIR/SHAKEN authentication framework on all IP networks.

What is STIR/SHAKEN, and How Does it Work?

STIR/SHAKEN allows voice service providers to differentiate legitimate calls from illegally spoofed calls by authenticating and verifying caller ID information for calls carried over IP networks. Simply put, the objective of STIR/SHAKEN is to enable voice service providers to confirm that carriers are responsible for authenticating calls by “signing” them with an encrypted digital signature and an attestation rating. 

A call marked “A” or “full” attestation means the provider can confirm both the caller’s identity and the legitimate use of the calling number. “B” or “partial” attestation means the provider can confirm the caller’s identity but not the telephone number. Lastly, “C” or “gateway” attestations mean the provider has originated the call on the network, but cannot authenticate the call source. The implementation of STIR/SHAKEN will restore consumers’ trust by reducing the effectiveness of illegal spoofing and allow consumers and law enforcement to identify bad actors more efficiently.

How Could STIR/SHAKEN Impact my Business?

Any business making calls to consumers or to other businesses could be negatively impacted if its service provider fails to meet and maintain compliance with STIR/SHAKEN. Service providers who fail to meet these requirements may have calls originating on their networks blocked. As a business making calls, you should check in with your service provider to ensure that they have met all STIR/SHAKEN requirements.

Questions you should consider asking your provider include:

• Have you implemented STIR/SHAKEN across your network? If not, when do you expect implementation to be complete?
• What level of attestation are my calls receiving?
• Have you filed a certificate with the Robocall Mitigation Database certifying that STIR/SHAKEN has been fully implemented across your network?
• Is there anything your service provider needs from your business in order to ensure that all calls are signed with full attestation?

Please reach out to us at connect@compliancepoint.com if you have any questions about this topic or how CompliancePoint can assist your organization with managing your marketing compliance.