STIR/SHAKEN is the framework US phone providers use to digitally sign outgoing calls with a statement of how confident they are that the caller is allowed to use the number shown. It helps the receiving network spot spoofed numbers, but it does not decide on its own whether your call says "Spam Likely". Those labels come from call analytics that look at how a number behaves. The fix usually involves both: calls signed at the highest attestation level, and calling patterns that do not look like a robocaller's.
General information about how the system works, not legal advice. Labeling is done by carriers and analytics companies, changes often, and is not fully public, so nobody can honestly promise that a number will never be flagged.
What STIR/SHAKEN does
STIR and SHAKEN are two sets of technical standards. Together they let the provider that originates a call attach a digital signature to it, which the provider at the receiving end can verify. Under the TRACED Act and FCC rules, US voice providers were required to implement it on their IP networks, with the largest providers going first and smaller ones given more time. Providers also have to file robocall mitigation information with the FCC, and downstream carriers are generally not allowed to accept calls from providers missing from that database.
The signature carries an attestation level, the originating provider's statement about what it knows:
| Level | Name | What the originating provider is saying |
|---|---|---|
| A | Full attestation | We know this customer, and they are authorized to use this calling number |
| B | Partial attestation | We know this customer, but we cannot confirm they are authorized to use this number |
| C | Gateway attestation | We received this call from somewhere else, often an international gateway, and cannot vouch for it |
Some calls arrive with no signature at all, because the signature can be lost where a call crosses older, non-IP equipment on its way.
Why a signed call can still say Spam Likely
Attestation tells the receiving carrier whether the number is probably genuine. It does not say whether the caller is someone the recipient wants to hear from. Mobile carriers and the analytics companies they work with score calls on other signals and label them on that basis. The exact formulas are not published, but the signals generally discussed include:
- High volumes of outbound calls from one number, especially in short bursts.
- Low answer rates and many very short calls.
- Calls to large numbers of people who have never called you.
- Complaints and spam reports from people who received the calls.
- A newly activated number, or one previously used by someone else, with no history of its own.
- Sequential dialing, or patterns that look like an automated dialer.
- Low attestation, or no signature.
So the businesses that run into labels most are the ones that call out in volume: clinics confirming appointments, contractors returning leads, sales and collections teams, and anyone using a dialer.
What a business can do
1. Get A attestation on your calls
The provider sending your calls should give them A attestation when you call from numbers it has assigned to you, or numbers it has verified you have the right to use. B attestation is common when the number you display lives with a different provider: calls sent through one platform while showing a number hosted elsewhere, or a calling tool that has no record of the number. Ask your provider what attestation your calls receive. If it is not A, ask what would make it A. Setups that send calls through a separate carrier, such as Teams direct routing or SIP trunks, deserve a specific check.
2. Register your numbers
The major analytics companies accept registrations from businesses, and several share a free registration portal for the purpose, known as the Free Caller Registry. Registering tells them who uses a number and why. It guarantees nothing, but it gives them information beyond call patterns. Some providers and third parties also sell registration and monitoring services.
3. Set your caller ID name
Make sure your outbound caller ID name, known as CNAM, is set to your business name with your provider. Many mobile phones do not show it by default, but landlines and some apps do, and it is part of looking legitimate.
4. Consider branded calling
Branded calling services display your business name, and sometimes a logo and a reason for the call, on the recipient's mobile screen. They are sold through carriers and specialist vendors, usually for a fee, and coverage varies by carrier and handset. Worth a look if outbound calling is central to your business.
5. Call like a business, not a dialer
- Use a small set of stable numbers rather than rotating through many.
- Spread outbound calls through the day instead of firing them in bursts.
- Call people who expect to hear from you: customers, leads who asked for a callback, people with appointments.
- Make sure callbacks to your outbound numbers reach a person or a proper greeting, not a dead end.
- Honor do-not-call requests promptly and keep your consent records.
6. If a number is flagged, ask for a review
The analytics companies and the major mobile carriers have processes for disputing a label you believe is wrong. Gather your business details and a description of how the number is used, and submit to each. Switching to a fresh number is tempting, but a new number with no history and the same calling pattern can be flagged again.
When someone else spoofs your number
A different problem with a similar feel: strangers call you back, annoyed, about calls you never made. That usually means a robocaller is displaying your number as its caller ID. STIR/SHAKEN makes this harder, because calls displaying your number without authorization should arrive with low attestation or none, but it does not stop it entirely, especially on calls that enter through gateways or older networks.
- Tell your phone provider, with the times and the numbers that called you back. Providers can see whether the calls came from their network.
- Put a short message on the line, or brief whoever answers, explaining that your number is being spoofed and that you did not call.
- File a complaint with the FCC, which collects spoofing reports.
- Watch your own number for spam labels, since complaints about the spoofed calls can attach to it.
It usually passes once the robocaller moves on to other numbers, though nobody can say when.
Rules that apply to outbound calls
Separate from labels, federal law restricts some outbound calls. Under the Telephone Consumer Protection Act, autodialed and prerecorded calls to mobile phones generally need prior express consent, and marketing calls of that kind generally need prior express written consent. The FCC has said that AI-generated voices count as artificial voices under the TCPA, so the same rules apply to AI calling. National and company do-not-call lists also apply to telemarketing, and some states add rules of their own. Our article on AI lead follow-up covers how consent fits into automated follow-up, and texting has its own carrier registration, covered in 10DLC registration.
A worked example
Hypothetical: the practice, call volumes and fixes are invented to show the method.
A physical therapy practice with three locations calls patients the day before their appointments. Patients start mentioning that the calls show as "Spam Likely", and fewer answer. The practice manager finds that all reminder calls go out through a reminder tool, around 200 calls between 4 and 5pm each day, all displaying the main office number, which is hosted with the practice's phone provider rather than the reminder tool.
- The reminder tool's calls are receiving B attestation, because it cannot verify the practice's right to use the main number. The practice takes one local number per location through the reminder tool, which signs them at A, and sets the caller ID name on each.
- Calls are spread across the afternoon, each location calling its own patients from its own number.
- The practice registers every number it uses and submits a dispute for the flagged main number.
- Callbacks to the reminder numbers ring the right front desk.
Within a few weeks, patients stop mentioning the label. The practice cannot know which change mattered most, and that is normal, since the analytics are not published. Each change is one a legitimate caller should make anyway.
Questions to ask your phone provider
- What attestation level do our outbound calls receive, from every system we call from?
- Are all the numbers we display assigned to us through you, or verified by you?
- How do we set our caller ID name?
- Do you offer branded calling, and on which carriers does it display?
- Do you monitor our numbers for spam labels, and do you help with disputes?
- Are you listed in the FCC's robocall mitigation database?
Calls that reach people
We price business voice and UCaaS and hosted phones across providers, and we ask the attestation, caller ID and branded calling questions for you, so the platform you choose signs your calls properly. Providers pay FiberX, so there is no markup, and our lowest-price promise applies. The consultation is free, you usually hear back the same day, and Phil Morales is your one point of contact. Get in touch, call 478-758-8091 or text (347) 870-0965.
