LinkedSIP opens soon. Sign-up, payments and calling are not open yet, and the rates shown are examples.
Sign inSwitch calling on
Switch calling onSign in

STIR/SHAKEN: a signature on caller ID

STIR/SHAKEN is how phone companies in the US and Canada prove a caller ID is genuine. The provider that starts a call signs the number with a grade, A, B or C, for how sure it is; the provider that delivers the call checks the signature. It shows a number is real, not that a call is wanted.

+1callerAsigned✓checked☎phone rings

Part of our SIP trunk guide. Updated 10 November 2026.

S/S

What the letters mean

Two sets of standards: one for the token, one for how carriers use it.

Caller ID used to be a plain text field any phone system could fill in, which is how scam calls showed a bank's number. The signature is something only the real provider can make.

STIR

Secure Telephone Identity Revisited

The internet standards (IETF) for the signed token, called a PASSporT, and the SIP Identity header that carries it.

SHAKEN

Signature-based Handling of Asserted information using toKENs

The telecom industry's rulebook (ATIS and the SIP Forum) for how carriers sign, check and grade calls.

4

How a call is signed and checked

Signed where the call starts, checked where it ends.

The token rides in a SIP Identity header on the call setup. Certificates come from approved authorities, so the checker learns which provider signed, not only that someone did.

  1. 1

    You call

    Your phone system sends the call with the number you chose to show.

  2. 2

    Signed

    The first North American provider adds a signed token: your number, the number called, and how sure it is of you.

  3. 3

    Checked

    The provider of the person you call fetches the signer's certificate and checks the token against the call.

  4. 4

    Shown

    Their phone shows the number, maybe a verified mark, or a spam label from separate analytics.

It needs IP the whole way. If the call crosses an old copper network, the header is usually lost and the call arrives unsigned. That is one reason a genuine call can arrive without a verified mark.

A

Attestation A, B and C

Two questions decide the grade. Find yours below.

Does the signing provider know the caller? And does it know the caller may use this number?

LevelKnows the callerKnows the number is theirs
AYesYes
BYesNo
CNo, only the entry pointNo

Which describes your calls?

Usual levelAFull attestation

Your own US or Canadian provider signs.

It knows you, and its own records show the number is yours. That is the case A was made for.

Each provider decides for its own customers, so confirm with yours.

{ }

Inside the signature

A PASSporT: a small signed JSON object, decoded.

SHAKEN adds the attestation and a tracing ID to the PASSporT standard. Values below are examples; the numbers sit in the 555-01xx range kept for fiction.

Header

alg
ES256Signing method: elliptic curve P-256
ppt
shakenFollows the SHAKEN rules
typ
passportThe kind of token
x5u
https://cert.example.net/sp.pemWhere a checker downloads the signer's certificate

Payload

attest
AThe attestation level
orig
{"tn":"12025550143"}The number shown as caller ID
dest
{"tn":["12125550123"]}The number called
iat
1794340000When it was signed, in seconds since 1970
origid
123e4567-e89b-12d3-a456-426614174000A unique ID that traces the call back to its signer
Signature: made with the provider's private key. Change one character above and the check fails. The called number and the time stop a token being copied onto another call or replayed later.
≠

What it does not do

It proves who let a call in. It does not judge the call.

"Spam Likely" and call blocking come from carriers' analytics, which use the attestation as one input among call volume, very short calls, complaints and how new a number is.

It does

  • Proves which provider let the call onto the network
  • Says whether that provider vouches for the number
  • Makes a faked number fail the check or arrive unsigned
  • Lets investigators trace a call back

It does not

  • Decide whether a call is spam
  • Block calls on its own
  • Survive old copper (TDM) links
  • Vouch for calls from abroad beyond C
FCC

Who has to use it

Required in the US and Canada on IP networks, with the circle still widening.

Every US voice provider also files in the FCC's Robocall Mitigation Database, and carriers must refuse traffic from providers that are not listed.

  1. Dec 2019US

    The TRACED Act directs the FCC to require caller ID authentication.

  2. 30 Jun 2021US

    Voice providers must sign and check calls on the IP parts of their networks.

  3. 30 Nov 2021Canada

    The CRTC deadline for calls on IP networks, with no small-provider exemption.

  4. 2022 to 2023US

    Extensions for small providers end, and the duty widens to gateway and intermediate providers.

  5. 18 Sep 2025US

    A provider that signs through a third party must use its own certificate, not borrow one.

  6. ProposedUS

    In April 2025 the FCC proposed frameworks and a two-year deadline for networks that are not IP.

!

If your calls show as spam

A good grade helps. These five habits matter as much.

Send every caller ID in international format: what E.164 format is.

  1. 1

    Show numbers you hold

    A number assigned by the provider that carries the call is what makes A possible.

  2. 2

    One caller ID per purpose

    Rotating through many numbers is a pattern analytics read as spam.

  3. 3

    Register your numbers

    Give your business name and call purpose to the analytics firms the large US carriers use.

  4. 4

    Watch your call patterns

    Many very short or unanswered calls raise a number's risk score whatever its attestation.

  5. 5

    Read the rejection code

    A refused call may return 603 Decline, or 608 Rejected, which is kept for calls stopped by analytics.

C

Calls from outside North America

Calling the US from abroad, or through us? The signer is at the border.

Calling family or clients there? Our guide to calling the United States covers dialling and rates.

GW

A gateway signs it

Calls from abroad enter through a US or Canadian gateway provider, which must sign them. It knows the network, not you, so C is usual.

ID

Your caller ID is set for you

On LinkedSIP the caller ID for each SIP login is set by our team and shown on your SIP logins page. Show only numbers you have the right to use.

?

No level is promised

The level depends on the carrier route into North America and the number you send, so we do not promise A, B or C.

Faked caller ID breaks our acceptable use rules and may be illegal where the call ends.

FAQ

STIR/SHAKEN questions

What does STIR/SHAKEN do?
It lets the provider receiving a call check that the caller ID was signed by a real provider, and how sure that provider was. Faked numbers fail the check or arrive unsigned, and every signed call can be traced back.
How do I implement STIR/SHAKEN?
A business does not sign calls itself; its voice provider does. Ask your provider which level your calls get, show numbers that provider assigned to you, and keep your caller ID consistent. Providers need an SPC token, a certificate and a Robocall Mitigation Database filing.
Can phone spoofing be traced?
A signed call carries an origination ID that leads back to the provider that signed it, and US carriers run industry traceback on illegal robocalls. Unsigned calls are harder to trace, which is one reason they draw suspicion.
Does STIR/SHAKEN stop robocalls?
Not on its own. It makes spoofed numbers easier to catch and calls easier to trace, while blocking and labels come from separate analytics. Robocalls from genuine numbers still get through the signature.
Why does my call show as spam with A attestation?
A only says the number is really yours. Analytics also weigh how many calls you make, how short they are, complaints and how new the number is, so a genuine number can still be labelled.
What does *77 do on your phone?
On many US landlines, *77 turns on anonymous call rejection: calls that hide their number are refused. *87 turns it off. It is a carrier feature, separate from STIR/SHAKEN, and not every line has it.

A trunk that is honest about caller ID. And capped by what you load.

Prepaid credit is your spending limit: our prepaid SIP trunk provider page has the details.

See the SIP trunkRead the SIP trunk guide