Caller ID has not solved all of the industry's spam problems. A robocaller can dial out with any number in the ‘from’ field (a practice known as caller ID spoofing). STIR/SHAKEN is the industry's answer to that gap.
What is caller ID spoofing?
Caller ID spoofing is the practice of deliberately falsifying the caller ID information transmitted with a phone call so the displayed number doesn't belong to the actual caller.
Anyone originating a call over SIP can typically set that field to whatever number they want. That's what makes it possible for a robocaller to show up on a phone looking like a bank, a government agency, or even a neighbor with a similar area code and prefix (sometimes called "neighbor spoofing").
Spoofing itself isn't always malicious. Some legitimate use cases exist, like a business displaying a central support line instead of an individual employee's number. But it's also the mechanism behind most scam and robocall traffic, which is why regulators and carriers built STIR/SHAKEN specifically to address it: not by making spoofing technically impossible, but by giving the receiving carrier a way to know whether the number was verified by the network that originated the call.
What is STIR/SHAKEN?
STIR/SHAKEN is a call authentication framework that lets a receiving carrier verify whether the caller ID on an incoming call was actually confirmed by the carrier that originated it.
STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) work together to attach a cryptographically signed token, called a PASSporT, to a call as it leaves the originating carrier's network.
The token travels in SIP Identity headers. The receiving carrier checks it and decides how much to trust the displayed caller ID, which in turn affects whether the call rings through clean, arrives labeled “Spam Likely” or “Scam Likely,” or gets blocked outright.
STIR/SHAKEN attestation levels
The token carries one of three attestation levels:
Level A (full attestation). The originating carrier authenticated the caller and confirmed the caller is authorized to use that number.
Level B (partial attestation). The carrier authenticated the caller but could not confirm the number is theirs to use.
Level C (gateway attestation). The call entered the carrier's network from an external source with no verified identity at all.
Attestation only exists where a carrier originates the call. A platform that resells someone else's SIP trunk is asking that trunk provider to vouch for its traffic. A platform that owns the origination path can sign for its own calls.
SignalWire's compliance and default STIR/SHAKEN attestation
SignalWire is STIR/SHAKEN compliant. By default, every outbound call placed from a phone number purchased on the SignalWire platform receives level C attestation.
Level A and level B attestation are available, but they require a vetting process. A customer who needs a higher attestation level, for example a call center that wants its outbound numbers to authenticate as fully verified, must open a support ticket to start that process.
How to achieve full STIR/SHAKEN attestation
Request a vetting review to move off the level C default. This is a support-driven process, not a self-service dashboard toggle, since it depends on the provider's knowledge of the customer, the use case, and the specific numbers involved.
Verify caller ID ownership
Before a phone number can be used as the outbound caller ID on a SIP endpoint, the customer proves ownership of it through a call-me-and-enter-code flow (or the equivalent REST API verified_callers resource). This is a separate control from attestation level, but it addresses the same underlying problem: making sure the number displayed on a call is actually controlled by the party placing it.
Neither control replaces the other. Attestation is what the network tells the receiving carrier about trust in the caller ID. Verified Caller IDs is what SignalWire enforces on its own customers before letting them assert a number as their own.
It's also worth remembering that attestation is a network-level signal, not proof of identity inside an application. Don't treat caller ID as sufficient for anything sensitive. A function handler that authorizes an account change based on the incoming caller ID alone is trusting a value that sits upstream of any attestation check. The recommended pattern is a second factor, such as a verification code, before acting on anything consequential.
The open source implementation: libstirshaken
SignalWire didn't just implement STIR/SHAKEN to satisfy the FCC mandate. It sponsored libstirshaken, an open source implementation of the framework built under the FreeSWITCH project, one of the earliest open source implementations of STIR/SHAKEN.
The goal was to put caller verification directly into developers' hands rather than leaving it locked inside proprietary carrier stacks, making it cheaper and simpler to generate the security certificates STIR/SHAKEN depends on.
Get started with outbound calling today
Create a free SignalWire account, purchase your first phone number, and connect with the community and team on Discord.
