T
Telephony SOPKnowledge Base
Search
← All topics

STIR/SHAKEN — Caller ID Attestation and the TRACED Act

STIR/SHAKEN is the FCC-mandated framework that cryptographically signs caller ID on IP-based voice calls. Originating carriers attest to caller identity at three levels — A (full), B (partial), C (gateway) — and downstream carriers verify the SIP Identity header to flag spoofed traffic. Required for all US carriers since 2021-06-30 under the TRACED Act.

stir-shakencaller-idtraced-actattestationrobocallsip
Agent trigger phrases: STIR SHAKEN · caller ID attestation · TRACED Act · SIP Identity header · attestation A B C · spoofed caller ID · robocall framework · signed caller ID

STIR/SHAKEN

STIR (Secure Telephony Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) are the IETF and ATIS standards that authenticate caller ID on IP-based voice calls. Originating carriers sign the calling number with a private key; terminating carriers verify the signature. The FCC required compliance for all US carriers by 2021-06-30 under the TRACED Act of 2019.

How the signature flows

  1. Originating carrier receives a SIP INVITE from a customer.
  2. Carrier evaluates how confident it is in the calling number's legitimacy.
  3. Carrier mints a JWT (the PASSporT) with claims for orig, dest, iat, and attest.
  4. The JWT is signed with the carrier's private key (issued by an STI-CA).
  5. The signed token is inserted in the SIP Identity header.
  6. Each transit and terminating carrier verifies the signature against the public cert.

Three attestation levels

| Level | Name | Meaning | |---|---|---| | A | Full attestation | Carrier authenticated the customer AND confirmed the customer is authorized to use the calling number | | B | Partial attestation | Carrier authenticated the customer but cannot confirm the customer owns the calling number | | C | Gateway attestation | Carrier received the call from an upstream gateway (often international) and cannot authenticate the origin |

Voice service providers must reach attestation A on traffic they directly originate from verified customers. Wholesale and resale traffic typically lands at B. International gateway traffic lands at C.

What downstream carriers do with the result

| Verification result | Common terminating behavior | |---|---| | Verified A | Display name shown, no spam label | | Verified B | Display name shown, may add "verified" indicator | | Verified C | Pass-through, may add "unverified" tag | | Verification failed | Many carriers add "Spam Likely" or "Scam Likely" caller ID tag | | Missing Identity header | Some carriers block, most add a warning label |

SignalWire and STIR/SHAKEN

SignalWire signs outbound calls automatically with Attestation A when the calling number is owned by the project and the project's BTN (Behind-The-Number) registration is complete. No customer config — happens at the carrier layer.

For BYOC (Bring Your Own Carrier) setups where the customer pushes calls from third-party SIP infrastructure into SignalWire for delivery, attestation drops to B because SignalWire cannot independently authenticate the origin.

Common failure modes

  • CNAM mismatch — STIR/SHAKEN does not push caller name. CNAM is a separate database lookup at the terminating switch. Signed call ID is the number, not the name.
  • Number not registered to BTN — number was ported in but the new carrier did not register the BTN. Attestation drops to B until BTN sync completes.
  • Spoofed call signed as A — happens when the originating carrier authenticates the customer but does not validate ownership. The TRACED Act gives FCC power to revoke STI certs for repeat offenders.
  • International call shows attestation C — expected. The terminating carrier may still allow it but with a verification warning.

How to check attestation in production

For SignalWire-originated calls, the Identity header is added to the egress SIP INVITE automatically. To verify a specific call:

  1. Pull the call detail record (CDR) from the SignalWire portal.
  2. Inspect the sip_identity field in the CDR JSON.
  3. Decode the JWT — the attest claim is "A", "B", or "C".

For inbound calls (PSTN → SignalWire), the Identity header is preserved end-to-end. SWML scripts can read it via %{call.sip_identity} if you need to branch on verification status.

TRACED Act enforcement

  • FCC has revoked STI certificates from repeat-offending carriers (multiple actions since 2023).
  • Carriers that fail to verify inbound STIR/SHAKEN by 2023-06-30 are subject to FCC enforcement.
  • Robocall mitigation programs (RMP) filings are required for any carrier that lacks full STIR/SHAKEN deployment.

When to care as an application developer

  • You must care if your callers are reporting "Spam Likely" tags. Run a BTN verification with your provider.
  • You must care if you use BYOC and want Attestation A — work with your carrier on a delegate certificate arrangement.
  • You probably don't need to care for typical SignalWire-originated traffic where the calling number is owned by your project.

References

  • ATIS-1000074: STIR/SHAKEN technical standard
  • FCC Order: TRACED Act implementing rules (2020-03-31)
  • IETF RFC 8224: Authenticated Identity Management in SIP
  • IETF RFC 8225: PASSporT — Personal Assertion Token
View raw JSON →Back to index