A legitimate outbound call can lose customer trust before anyone answers it. When a number is mislabeled as spam, spoofed by a bad actor, or routed through a provider that cannot verify its origin, the result is lower answer rates, damaged brand credibility, and potential compliance exposure. This STIR SHAKEN guide explains what enterprise leaders need to know about authenticated calling and how to prepare their voice environment.
What STIR/SHAKEN Does
STIR/SHAKEN is a call authentication framework designed to reduce illegal caller ID spoofing in the U.S. telephone network. STIR stands for Secure Telephone Identity Revisited, while SHAKEN stands for Secure Handling of Asserted information using toKENs. The terminology is technical, but the business purpose is direct: help receiving carriers determine whether a caller ID is likely being used legitimately.
When a call is placed, the originating service provider can digitally sign information associated with the call. That signature travels with the call through supported networks. The terminating provider can then validate the signature and use the result as one signal when deciding how to present, analyze, or label the call.
STIR/SHAKEN does not guarantee that every call will be answered, eliminate spam labels, or prove that the caller’s message is legitimate. It confirms information about the call’s origin and the provider’s relationship to the displayed number. That distinction matters. A properly authenticated call may still be unwanted by its recipient, while a valid business may still see its calls challenged if its dialing practices create consumer complaints.
Why Call Authentication Matters to Businesses
For organizations that depend on outbound calling, caller ID trust is an operational issue, not simply a carrier-side technical detail. Sales teams, contact centers, appointment desks, schools, healthcare-adjacent operations, public agencies, and service departments all rely on people recognizing and answering their calls.
Spoofing has made that harder. Criminals often display local, familiar, or trusted numbers to encourage call recipients to answer. When a business number is impersonated, customers may associate fraudulent calls with the legitimate organization. The organization can then face a difficult problem: it has not made the calls, but it still bears the reputational cost.
Call authentication supports a stronger chain of accountability across the voice ecosystem. It can also help an organization identify gaps in its own configuration, such as unverified numbers, unauthorized outbound routes, incomplete inventory records, or providers with unclear compliance processes.
For regulated organizations, this visibility has added value. A documented approach to number ownership, user access, call routing, and vendor oversight supports broader security and continuity practices. STIR/SHAKEN is not a replacement for compliance controls, but it should fit within a disciplined communications governance program.
Understanding STIR/SHAKEN Attestation Levels
Authentication is commonly expressed through three attestation levels: A, B, and C. These levels describe the originating provider’s confidence in the caller’s right to use the displayed number. They are not a quality score for the business itself.
A Attestation: Full Attestation
A attestation means the provider knows the customer placing the call and can confirm that customer is authorized to use the calling number. This is generally the target for enterprise-owned numbers that are provisioned and managed through the organization and its authorized voice provider.
Receiving a high attestation level is valuable, but it requires accurate records and controlled routing. If an organization ports numbers frequently, uses several providers, or allows departments to activate numbers outside central IT oversight, the provider may not have sufficient information to apply full attestation consistently.
B Attestation: Partial Attestation
B attestation means the provider knows the customer placing the call but cannot confirm the customer’s right to use the specific caller ID number. This can occur in legitimate scenarios, including certain hosted applications, partner-managed calling arrangements, or configurations where the displayed number is not directly assigned by the originating provider.
B attestation is not necessarily a problem. It does, however, indicate that the relationship between the caller, provider, and displayed number needs closer review if trusted outbound calling is a priority.
C Attestation: Gateway Attestation
C attestation means the provider can identify where the call entered its network but has limited ability to verify the caller or the right to use the calling number. It is often associated with calls entering from interconnected networks. Businesses should not assume that every C-attested call is fraudulent, but repeated C attestation for primary outbound business traffic warrants investigation.
What Your Organization Is Responsible For
The provider handles much of the technical signing and verification process, but the business has responsibilities that directly affect authentication quality. The most useful starting point is an accurate inventory of every number used for outbound calling.
That inventory should include main numbers, department direct-dial numbers, toll-free numbers, temporary campaign numbers, contact center caller IDs, emergency notification numbers, and numbers used by third-party platforms. It should identify the responsible department, the underlying provider, the application or trunk used to place calls, and whether the organization has documented authorization to display that number.
Next, establish a clear caller ID policy. Employees, departments, and vendors should not be able to substitute arbitrary outbound caller IDs. A well-intended local-presence strategy can become a trust and compliance concern when it relies on numbers the organization does not own or control. The right approach depends on the use case, but governance should be consistent.
Organizations also need to monitor their calling behavior. High-volume, short-duration calling; sudden spikes from unfamiliar extensions; repeated calls to recipients who do not answer; and high complaint rates can all affect deliverability and reputation. Authentication confirms identity information. It does not excuse calling practices that recipients experience as unwanted.
A Practical STIR SHAKEN Guide for IT Leaders
Preparation does not require rebuilding a voice environment overnight. It does require coordination among IT, telecom, security, compliance, operations, and any teams that operate customer-facing calling platforms.
Start by asking your voice provider how it applies STIR/SHAKEN signing to each outbound service type. SIP trunks, UCaaS platforms, contact center systems, Microsoft calling environments, and third-party applications may have different routing paths and number-management models. Ask which attestation level is expected for your primary numbers, what evidence the provider needs, and how exceptions are handled.
Then validate number ownership and routing. Confirm that numbers ported from another carrier, numbers acquired through an acquisition, and numbers used in cloud applications are properly associated with the correct legal entity and account. Pay particular attention to numbers presented by call center software or CRM dialers, where caller ID settings may be managed separately from the underlying voice carrier.
Review access controls as well. Limit who can alter outbound caller ID, provision new numbers, change dial plans, or add external trunks. For government contractors and organizations operating in controlled environments, this should align with existing identity, change-management, and audit practices.
Finally, create an escalation path for call labeling or spoofing incidents. Staff should know where to report a customer complaint about fraudulent calls that appear to come from the organization. The response process should preserve call examples, dates, displayed numbers, impacted locations, and provider details. This gives the telecom team actionable information and helps distinguish a configuration issue from external impersonation.
Common Gaps That Undermine Trusted Calling
The most persistent STIR/SHAKEN problems are rarely caused by the standard itself. They usually stem from fragmented communications ownership. A company may have one provider for headquarters, another for regional offices, a separate contact center platform, and unmanaged analog or legacy lines still in service. Each environment can apply caller ID differently.
Another common gap is treating number porting as an administrative task rather than a service transition. A port may complete successfully while records, caller ID settings, emergency calling information, or authentication expectations remain incomplete. Testing should include more than dial tone. It should confirm inbound and outbound routing, caller ID presentation, attestation where available, failover behavior, and service desk ownership.
Some organizations also expect authentication to resolve spam labeling immediately. Carrier analytics use multiple signals, and labeling decisions may vary by provider and recipient device. If a legitimate number is repeatedly flagged, investigate the complete picture: call volume, call patterns, answer rates, complaints, number history, outbound platform configuration, and authentication status.
Choosing a Provider for Authenticated Calling
A capable voice provider should be able to explain STIR/SHAKEN in business terms and provide clear answers about signing, attestation, number management, and incident support. For organizations with complex or regulated requirements, the provider should also understand how secure voice architecture, redundancy, auditability, and continuity planning intersect with authenticated calling.
Avoid treating this as a checkbox during a carrier selection process. The better question is whether the provider can support your operating model as it changes. A distributed organization may need centralized number governance across multiple sites. A government contractor may need voice services aligned with a controlled cloud environment. A growing contact center may need careful controls over application-based calling and number presentation.
Intuity helps organizations design cloud voice environments with the visibility, reliability, and support needed to manage business calling responsibly. The appropriate configuration depends on your numbers, call flows, applications, security requirements, and the teams responsible for day-to-day operations.
Trusted calling is built over time through verified number ownership, controlled caller ID, responsible outreach practices, and a provider that can explain what is happening on the network. Treat STIR/SHAKEN as part of that operating discipline, and your organization will be better positioned to protect its identity when every answered call matters.