STIR/SHAKEN are two separate initiatives that work to verify the identity of an inbound call in efforts to deter illegal caller ID spoofing. STIR, Secure Telephony Identity Revisited, and SHAKEN, Signature-based Handling of Asserted information using toKENs are mandated in North America. Since its origin in 2020 ¹, governing bodies CRTC, Canadian Radio-television and Telecommunications Commission, and the FCC Federal Communications Commission will oversee its implementation and maintenance.

A Little Bit About Illegal Caller ID Spoofing

Spoofing, as the name suggests, is the intentional act of tricking someone. In the context of telecommunications, it involves disguising the original CNAM, Caller NAMe, and/or CID, Caller ID. Opting for a private or unknown caller CNAM will warrant at best, a 19% answering rate in the U.S. ². Scammers armed with this knowledge, utilize the CID of other individuals and companies, without permission. This illegal activity damages the reputation of major companies and organization, creates more fear and hesitancy around answering calls and, increases the efficacy of fraud.

How Does It Work?

STIR leverages three levels of verification, corresponding to different levels of security, to determine whether a call should be trusted via VoIP systems. This technology verifies information at several points in the call, disabling hackers from beating this authentication system. SHAKEN was created to address non-VoIP systems, such as the conventional cellphone. This results in providing the user with verified information, appended with tags such as verified or no verification. Note that messages may differ across devices and carriers types.

Does this mean I am safe from spoofing?

The short answer is no. STIR/ SHAKEN aids to verify a call, but does not prevent or block unverified calls.

STIR/SHAKEN guidelines have yet to be fully implemented in North America. Canada is in the beginning stages of implementation, while in the U.S., the FCC has granted extensions up until June 2023 for carriers with fewer than 100,000 subscribers ³. Additionally, numbers can only be verified if the device is compatible, and both carriers have adopted the guidelines.

To learn more about protecting your company's number from getting spoofed visit SIPSTACK.

References

^{1 https://www.fcc.gov/call-authentication 2 McClain, Colleen. "Most Americans don't answer cellphone calls from unknown numbers." (2020). 3 https://www.fcc.gov/call-authentication}