TIR/SHAKEN is a set of IETF and ATIS standards that cryptographically sign the calling number when a call originates, so the terminating carrier can verify it was not spoofed. In 2026 it is mandated across North American networks and spreading internationally, but it authenticates the number — not the caller's intent.
The problem: caller ID was never authenticated
For most of telephony's history, the calling number presented to the person you are ringing was simply asserted by the originating side and trusted end to end. Nothing checked that the caller was entitled to use that number. That gap is what makes caller-ID spoofing trivial and what powers robocalls, impersonation scams, and neighbour-spoofing fraud. STIR/SHAKEN closes it by adding a verifiable cryptographic signature to the call setup.
How STIR/SHAKEN works
STIR (Secure Telephone Identity Revisited) is the IETF's underlying mechanism. RFC 8224 defines how a signed Identity header is carried in SIP; RFC 8225 defines PASSporT, the signed token that asserts the calling number; and RFC 8226 defines the certificate framework that binds signing authority to a service provider. SHAKEN (Signature-based Handling of Asserted information using toKENs) is the ATIS/SIP Forum profile that specifies how carriers deploy STIR across their networks using a governance and certificate hierarchy.
- The originating provider authenticates the call and creates a PASSporT asserting the calling number, signed with its private key.
- The signature is inserted into the SIP Identity header and travels with the call.
- Intermediate networks pass the signed call through toward the destination.
- The terminating provider retrieves the signer's public certificate, verifies the signature, and confirms the calling number was not tampered with — then applies its own display or spam treatment.
The three attestation levels
STIR/SHAKEN does not claim the caller is trustworthy — it records how confident the originating provider is that the caller may use the number. That confidence is expressed as an attestation level in the PASSporT.
| Attestation | Name | What the originating provider is asserting |
|---|---|---|
| A | Full attestation | Known customer and confirmed right to use the calling number |
| B | Partial attestation | Known customer, but the number could not be confirmed |
| C | Gateway attestation | Call entered from another network/gateway; origin not verifiable |
What it does and does not stop
The framework is powerful but narrow. Understanding its scope prevents over-reliance.
- It does verify that the displayed calling number was not spoofed in transit and records the originator's attestation.
- It does give terminating carriers and analytics engines a trustworthy signal to feed spam labelling and blocking.
- It does not prove the caller's intent — a fully attested call from a real number can still be a scam.
- It does not by itself label or block calls; that is a separate analytics and policy decision built on top of the signature.
- It works natively only on IP (SIP) call paths; calls traversing legacy TDM segments can lose the signature.
Caller-ID authentication is a trust signal, not a verdict. Pair it with behavioural analytics: our answer on telecom fraud prevention covers how attestation feeds scoring, and BroadNet's programmable voice and voice API / SIP trunking references explain where the signature lives in the call flow.
The global picture in 2026
Caller-ID authentication began as a North American mandate — the FCC required STIR/SHAKEN on IP networks in the United States, and Canada's CRTC followed — and the model is now spreading. France and other markets have introduced their own caller-ID authentication or number-verification regimes, and industry bodies are working toward cross-border interoperation. The direction is clear, but coverage is uneven: a signed call in one country may cross into a network that cannot verify it, which is why analytics and reputation still do heavy lifting alongside the cryptography. For where the signature sits technically, see our references on SIP headers and the SIP protocol overview.
Frequently asked questions
Does STIR/SHAKEN stop all robocalls?
No. STIR/SHAKEN verifies that a calling number was not spoofed and records the originating provider's attestation, but it does not judge intent. A legitimate, fully attested number can still place unwanted or fraudulent calls. Its value is providing a trustworthy signal that spam-analytics and blocking systems use to make better labelling and filtering decisions — it is an input to enforcement, not enforcement itself.
What do attestation levels A, B, and C mean?
They express how confident the originating provider is about the call. Level A (full) means a known customer with a confirmed right to use the number; level B (partial) means a known customer whose number could not be confirmed; level C (gateway) means the call entered from another network and its origin cannot be verified. Terminating carriers weigh these levels when deciding how to treat and display a call.
Is STIR/SHAKEN used outside the United States?
It started in North America under the FCC and Canada's CRTC, and caller-ID authentication is now spreading internationally, with markets such as France introducing their own regimes. Coverage is still uneven and cross-border verification is a work in progress, so the framework is best understood as a growing global direction rather than a universally deployed standard in 2026.
Does STIR/SHAKEN work on non-IP (TDM) networks?
Not natively. The signature is carried in the SIP Identity header, so it depends on an IP call path. When a call crosses a legacy TDM segment, the signature can be dropped and the attestation lost. Bridging the gap for calls that traverse older infrastructure — through out-of-band mechanisms — is an active area of standards work.
References
- IETF — RFC 8224, Authenticated Identity Management in SIP: datatracker.ietf.org
- IETF — RFC 8225, PASSporT: Personal Assertion Token: datatracker.ietf.org
- IETF — RFC 8226, Secure Telephone Identity Credentials (Certificates): datatracker.ietf.org
- ATIS — SHAKEN standards and call authentication: atis.org
- FCC — Call authentication / STIR/SHAKEN: fcc.gov