We’re sure you’ve received at least one robocall in the last month. <\/p>\n\n\n\n
Right? <\/p>\n\n\n\n
They are everywhere, interrupting family dinners, and your silent Sunday morning routine. Even your company phone number gets them. Or, worst of all, your customers get suspicious robocalls using your company’s name that compromises your public image. <\/p>\n\n\n\n
They look like legit phone calls, so you’re never sure if a real person is trying to reach you, if it’s a scam, another robot offering something you have no interest in or luring your customers into a scam. <\/p>\n\n\n\n
So what to do? <\/p>\n\n\n\n
VoIP providers, traditional telecom companies and the government teamed up to help by creating a system that authenticates telephone numbers before a call is received. <\/p>\n\n\n\n
Phone number authentication is a big deal because it validates the ID of the original caller. This technology is called STIR\/SHAKEN, and complying to it is mandatory in the United States. <\/p>\n\n\n\n
Let’s learn more about how this regulatory technology work and how it combats ID spoofing and robocalls, and, also, how it affects your business communications. <\/p>\n\n\n\n
First things first. STIR\/SHAKEN is a combination of two acronyms: <\/p>\n\n\n\n
STIR\/SHAKEN is a set of industry protocols that helps verify a caller\u2019s identity by confirming they\u2019re authorized to use the phone number they\u2019re calling from. <\/p>\n\n\n\n
When a call is placed, the provider attaches a digital signature to confirm the level of confidence they have in that particular call. This information travels with the call so the receiving provider can check its authenticity, helping to filter out calls like scams or robocalls before they reach the recipient. <\/p>\n\n\n\n
This process assists call recipients in protecting themselves against caller ID spoofing, maintaining their trust in the phone service. <\/p>\n\n\n\n
When we talk about Voice over Internet Protocol, STIR\/SHAKEN uses the Session Initiation Protocol (SIP) header to validate VoIP calls and transmit the authentication certificate. <\/p>\n\n\n\n
STIR\/SHAKEN employs digital certificates and public key cryptography to confirm that the displayed calling party matches the actual source of the call. <\/p>\n\n\n\n
To better understand how this works, let’s look at each protocol separately: <\/p>\n\n\n\n
STIR operates within VoIP networks. When a call is initiated, the originating service provider assesses the call’s source and assigns an attestation level: <\/p>\n\n\n\n
This information is encapsulated in a digital signature, known as a PASSporT (Personal Assertion Token), which is attached to the call’s SIP identity header. <\/p>\n\n\n\n
SHAKEN provides guidelines for how service providers should handle and verify these digital signatures across their networks. When a call reaches the terminating provider, they use the originating provider’s public key to decrypt the PASSporT and verify the call’s authenticity. <\/p>\n\n\n\n
Depending on the verification result, the call can be: <\/p>\n\n\n\n
By verifying the caller\u2019s identity, terminating providers can label or block calls accordingly, therefore offering end users more transparency and helping prevent suspicious activity. <\/p>\n\n\n\n
Yes, if you are a reseller or business owner that owns and uses U.S. phone numbers. If you are a U.S. telephony provider or use U.S. phone numbers for outbound calls (which can be quite common for call centers and VoIP resellers), it is mandatory that you comply with STIR\/SHAKEN. <\/p>\n\n\n\n
Regulation was made mandatory in 2021 for large carriers and in 2022 for small and rural carriers as a response to the rise in robocalls all over the U.S. In December 2023, for example, Americans received over 3 billion robocalls\u2014almost 17 spam calls<\/strong><\/a> per person. <\/p>\n\n\n\n That’s a lot, right? <\/p>\n\n\n\n It also explains why the FCC, the U.S.\u2019 Federal Communications Commission, releases updates regarding STIR\/SHAKEN regulations frequently, to keep up with increased call spoofing and robocalls. <\/p>\n\n\n\n Let’s take a look at what’s new for 2025. <\/p>\n\n\n\n As mentioned before, the FCC has announced new requirements under its Eighth Report and Order<\/strong><\/a>. These updated rules impact voice service providers that resell VoIP services in the U.S. and are set to go into effect on June 20, 2025<\/strong>. <\/p>\n\n\n\n The biggest takeaway is that providers with a STIR\/SHAKEN implementation requirement should no longer rely on its upstream, as per June 20th<\/sup>, 2025, to sign calls on their behalf. <\/p>\n\n\n\n Providers will also need to update their Robocall Mitigation Plan in FCC’s Robocall Mitigation Database<\/strong><\/a> to explain what are their actions related to robocalls, even if they don’t have an obligation for STIR\/SHAKEN implementation. <\/p>\n\n\n\n The FCC emphasizes that all providers, regardless of their STIR\/SHAKEN implementation status, must properly certify their position: <\/p>\n\n\n\n \u201cCurrently, all voice service providers, all gateway providers, and certain non-gateway intermediate providers are required to implement STIR\/SHAKEN in the IP portions of their networks unless subject to an implementation extension.\u201d <\/p>\n<\/blockquote>\n\n\n\n If you are a VoIP reseller subject to STIR\/SHAKEN requirements, you will need to take the following steps: <\/p>\n\n\n\n Even if you are not<\/strong> currently obligated to implement STIR\/SHAKEN, updating your mitigation plan is still highly recommended to remain compliant and transparent with FCC expectations. <\/p>\n\n\n\n Ok, let’s get into the specifics of what STIR\/SHAKEN protocols can do. As we mentioned before, this is a framework designed to combat caller ID spoofing by verifying the authenticity of phone calls. <\/p>\n\n\n\n It helps remediate and reduce various types of suspicious calls by ensuring that the displayed caller ID matches the actual source of the call. <\/p>\n\n\n\n Here are some common types of calls STIR\/SHAKEN aims to address: <\/p>\n\n\n\n Phishing calls involve scammers impersonating legitimate organizations (like banks or government agencies) to trick individuals into revealing sensitive information, such as passwords or credit card numbers. <\/p>\n\n\n\n By authenticating caller ID information, STIR\/SHAKEN makes it more difficult for attackers to spoof trusted numbers, thereby reducing the effectiveness of phishing attempts. <\/p>\n\n\n\n Robocalls are automated calls that deliver pre-recorded messages, often used for telemarketing or scams. <\/p>\n\n\n\n STIR\/SHAKEN helps reduce robocalls by allowing service providers to certify whether they can confirm a call is truly coming from the number it claims to use. <\/p>\n\n\n\n When a call is passed with a lower certification, terminating providers may choose to flag it as spam or block it entirely, depending on their policies. This extra layer of validation improves the chances of keeping robocalls out of consumer inboxes. <\/p>\n\n\n\n Vishing, short for \u201cvoice phishing\u201d, is a type of scam where attackers use phone calls to deceive individuals into providing personal or financial information. <\/p>\n\n\n\n These calls often appear to come from trusted sources due to caller ID spoofing. STIR\/SHAKEN combats vishing by ensuring that the caller has the right to pass caller ID information, otherwise the call will be signed with a lower certification, making it easier for individuals to identify and avoid fraudulent calls. <\/p>\n\n\n\n In tech support scams, fraudsters pose as technical support agents from reputable companies, claiming that the victim’s computer has issues that need immediate attention. They may request an update on software, remote access or payment for unnecessary services. <\/p>\n\n\n\n STIR\/SHAKEN helps prevent these scams by providing the correct certification for the caller’s number, making it harder for scammers to impersonate trusted organizations. <\/p>\n\n\n\n Want to stop receiving spam calls on your VoIP.ms phone number? Take a look at this tutorial: <\/p>\n\n\n\nSTIR\/SHAKEN 2025: What’s new <\/h2>\n\n\n\n
\n
What does this mean for you? <\/h3>\n\n\n\n
\n
\n
NOTE<\/strong>: Remember that, as a reseller, you will need to assign attestations for your customers\u2019 outgoing calls, meaning you need to be sure of your customer’s information before signing their call with a certificate. If you cannot validate that the caller ID is owned by your customer, you have to assign it a lower attestation. Non-compliance to STIR\/SHAKEN can result in legal and financial penalties, from fines to cease-and-desist orders from the FCC. <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Type of calls STIR\/SHAKEN mitigates <\/h2>\n\n\n\n
\n
\n
\n
\n
Phishing <\/h3>\n\n\n\n
Robocalls <\/h3>\n\n\n\n
Vishing <\/h3>\n\n\n\n
Tech support scams <\/h3>\n\n\n\n