STIR/SHAKEN signs the call. It does not vouch for the caller.

The short answer

A business owner who hears that "the carriers fixed robocalls with STIR/SHAKEN" and then finds their own calls marked "Spam Likely" usually assumes something is broken. Usually nothing is. The two things were never the same system.

STIR/SHAKEN is a signature scheme. The provider that puts a call onto an IP voice network signs a small token saying which number is calling, which number is called, when, and how sure the provider is that its customer may use that calling number. The far-end provider checks the signature. That is all. The IETF standard that defines the signature is explicit: "The verification of an Identity header field does not entail any particular treatment of the request."1 What happens to the call afterwards is, in the standard's words, a matter of "local policy".1

That local policy is where "Spam Likely", "Scam Likely" and "Potential Spam" come from. The SHAKEN framework itself describes the function that applies them as a separate, optional box, the Call Validation Treatment, "for applying call analytics and treatment techniques once the signature is positively or negatively verified".4

What STIR/SHAKEN actually signs

"STIR" is the IETF working group and its standards; "SHAKEN" is the North American industry profile of those standards, published jointly by ATIS and the SIP Forum. Four documents do the work:

• RFC 8225, PASSporT (February 2018) defines a signed token that "cryptographically verifies an originating identity or, more generally, a URI or telephone number representing the originator".2 Every PASSporT must carry an "orig" and a "dest" claim and an "iat" (issued-at) time.2
• RFC 8224, SIP Identity (February 2018) defines how that token travels in a SIP Identity header and how a receiving network verifies it. It exists because, without it, "the recipient of a SIP request has no way to verify that the From header field has been populated appropriately."1
• RFC 8588 (May 2019) adds the two claims that make the token "SHAKEN": an attestation level and an origination identifier, "a unique origination identifier ... to support a traceback mechanism".3
• ATIS-1000074.v003, the SHAKEN standard itself (approved 16 August 2022), defines the attestation levels, the certificate roles, the verification procedure and what the terminating network tells the handset.4

This is RFC 8588's own example of a SHAKEN token payload, unchanged (the two missing commas are the RFC's):3

{
   "attest":"A"
   "dest":{"tn":["12155550131"]}
   "iat":"1443208345",
   "orig":{"tn":"12155550121"},
   "origid":"123e4567-e89b-12d3-a456-426655440000"
}

Look at what is not there: no business name, no reason for the call, nothing about consent, volume or intent. RFC 8224 is explicit that the check covers the number in the From header and "does not cover the display-name portion of the From header field (e.g., "Alice Atlanta")".1 The name your customer sees comes from a different system again (more on that below).

Signatures are also short-lived: RFC 8224 has the verifier check the Date header against a freshness window, "sixty seconds is RECOMMENDED",1 which limits replaying a captured token later.

When verification succeeds, the terminating network tells the handset with a verstat parameter on the calling number. ATIS-1000074 says the value "TN-Validation-Passed" is sent only if verification passes and either the attestation was "A" or the attestation level itself is also passed to the device; for B or C, the network sends "No-TN-Validation" or omits the parameter, "based on local policy".4 So the checkmark or "Verified" tag some phones show is, by design, the display of a verification result, in the normal case for an A-level call. It says nothing about who the caller is beyond the number, or why they are calling.

Attestation levels A, B and C, and what each really means

The attestation level is the signer's statement about its own knowledge. RFC 8588 defines the values "'A', 'B', or 'C'", corresponding to "'Full Attestation', 'Partial Attestation', and 'Gateway Attestation', respectively", and defers to ATIS for the definitions.3 Those definitions, quoted from ATIS-1000074.v003:4

Scroll the table sideways to see every column.

Two notes in the standard matter more than the table. How a provider establishes the "verified association" is left to it: ATIS gives examples, such as the provider "has ascertained that the customer is authorized to use a TN (e.g., by business agreement or evidence the customer has access to use the number)", then says "Ultimately it is up to service provider policy".4 And B means the signer "can trace the origination of the call to a customer".4 B is a traceability promise, not an accusation.

How much an "A" is worth in practice

The FCC's July 2026 proposal to tighten attestation rules is the most candid public document on this. By asserting A, it says, "the provider is claiming that is has knowledge that the number has not been spoofed".22 It then sets out evidence that A is handed out too freely:22

• The FCC "found that Lingo Telecom applied A-level attestations to 3,978 spoofed robocalls" carrying a deepfake voice of the then-President.
• "93.4% of robocall traffic from the most prolific robocall signers now carry A-level attestations" and "48 percent of illegal calls are A-attested" (data the FCC quotes from the record).
• Of "12,900 calls that illegally spoofed telephone numbers belonging to 47 large banks, retailers, and healthcare providers", an American Bankers Association analysis found "more than half of the calls received an A-level or B-level attestation."
• Transaction Network Services reported that in the first half of 2025, "certain top tier carriers had marked around 8% of their invalid number calls with A-level attestation, and non-top tier carriers had marked 57%".

These are third-party figures quoted by the FCC, not FCC measurements. But they explain why an analytics engine cannot treat an A as a pass, and the FCC says so: "Because voice service providers also use attestations to inform call analytics engines, improper attestations can undermine their effectiveness, contributing to inaccurate blocking and labeling determinations."22 In the same notice it asks whether, if attestation were made trustworthy, it "should prohibit blocking or spam labeling of calls with A-level attestations".22 That question is the clearest official confirmation that, today, an A-attested call can lawfully be blocked or labelled.

Our view: attestation is necessary hygiene and nowhere near sufficient. A business that gets B or C has a fixable problem with its provider; a business that gets A and is still labelled has a reputation problem, which is a conversation with different people.

The US rules: what the FCC requires, section by section

The statute. The Pallone-Thune TRACED Act (Pub. L. 116-105, enacted 30 December 2019) told the FCC to require STIR/SHAKEN "in the internet protocol networks" of voice providers within 18 months, and "reasonable measures to implement an effective call authentication framework in the non-internet protocol networks".7 It also required a ban on line-item charges for the technology and "a process to permit a calling party adversely affected by the information provided by the call authentication frameworks ... to verify the authenticity of the calling party's calls".7 That last clause is the statutory root of the redress rights discussed below.

The regulations sit in 47 CFR Part 64, Subpart HH, §§ 64.6300 to 64.6308. The current text, read on eCFR for this page:

Scroll the table sideways to see every column.

The FCC's own summary: "Because the STIR/SHAKEN framework is only operational in IP networks, Commission rules also require providers using older forms of network technology to either upgrade their networks to IP or actively work to develop a caller ID authentication solution that is operational in non-IP networks."17

The non-IP gap is real and, by one measure, widening

A call that crosses a TDM (circuit-switched) segment loses its signature. The FCC's 2026 notice quotes TransNexus statistics showing that "the percentage of calls terminating in the United States that are signed with STIR/SHAKEN dropped from 49% in October 2024 to 38% in September 2025", attributed "at least in part, to the routing of calls over non-IP segments", and records ACA International's claim that "scam calls are deliberately routed through TDM interconnections for the purpose of stripping out STIR/SHAKEN information".22

In June 2025 the FCC proposed to end the working-group option: to require "all providers using non-IP technology in their networks to implement one or more non-IP caller ID authentication frameworks within two years", proposing that in-band authentication (ATIS-1000095) and out-of-band authentication (ATIS-1000096) are "developed and reasonably available".19 As of the date on this page we found no final rule adopting that proposal in the Federal Register, and the eCFR text of § 64.6303 still contains the working-group alternative.11 Treat any summary that says non-IP authentication is already mandatory as ahead of the law.

The Robocall Mitigation Database is being policed, and it shows

Rules effective 5 February 2026 set "a base forfeiture of $10,000 for each violation for filers that submit false or inaccurate information to the Database, as well as a base forfeiture of $1,000 for failure to update information that has changed in the Database within 10 days".21 A September 2026 proposal records "over 11,000 filings", "over 1,400 deficient filings" removed since January 2025, and, tellingly for anyone who assumes their provider signs calls, that "6,689 RMD filings indicate full or partial implementation of STIR/SHAKEN, but that only 2,143 providers appear on the Governance Authority's list of authorized providers."23

If your provider is de-listed, others may not accept its traffic directly at all.13 The Database is public: the FCC's (now archived) page about it says "you may search the database for filings or download a .CSV file of all filings".34

Spoofing your own number is not the offence

The Truth in Caller ID rule prohibits transmitting "misleading or inaccurate caller identification information" only when done "with the intent to defraud, cause harm, or wrongfully obtain anything of value".16 Showing your own business number on calls placed from a mobile or a cloud dialler is lawful. Mechanically it is also what a spoofer does, which is why, under the ATIS criteria, the sending provider can only give it A once it has verified the number is yours.4

Canada: the CRTC mandate and how it differs

The CRTC made STIR/SHAKEN mandatory in Compliance and Enforcement and Telecom Decision CRTC 2021-123 (6 April 2021). It made STIR/SHAKEN for IP-based voice calls "a condition of offering and providing telecommunications services, effective 30 November 2021", under sections 24 and 24.1 of the Telecommunications Act; the Canadian Secure Token Governance Authority (CST-GA) selects the Policy Administrator and Certificate Authority.24

Three points of difference from the US are worth knowing:

• No small-provider carve-out. The CRTC reasoned that "Excluding some TSPs from the obligation to implement STIR/SHAKEN, or delaying their obligation to implement it, would undermine the effectiveness of the system".24 The US, by contrast, gave providers with 100,000 or fewer lines an extension to 30 June 2023.12
• IP calls only, by design. The obligation "applies to calls that travel over a TSP's IP-based network, including any portion of its network that is able to initiate, transit, or terminate IP-based calls", and the CRTC declined to limit it to calls that are IP end to end.24
• Certificate access was contested. In 2021 CST-GA rules meant "a TSP must have access to numbering resources in order to receive a certificate".24 The CRTC's 2024 reporting template refers to a later determination (CETD 2021-267) after which more providers obtained certificates, and lets a provider say it is "Satisfied with having calls originating from our network attested and signed downstream (e.g. by the underlying LEC)".25

In December 2025 the CRTC ended semi-annual status reports for most providers, finding that "on average, TSPs employ STIR/SHAKEN successfully to authenticate the vast majority of their IP-based voice calls".26 Its remaining simplified report still asks whether a provider gives "A level attestation or B level attestation to non-IP switched customers" under the industry's STIR/SHAKEN Guidelines and whether it sends the verstat parameter to end users at all.26 So in Canada, as in the US, whether your customer's phone shows any verification indicator is a provider choice.

In the CRTC documents we read we found no Canadian counterpart to the public Robocall Mitigation Database or the FCC's caller redress rule, and no first-party Canadian registration portal; the Free Caller Registry asks for "10-digit US phone numbers".27 Canadian businesses should ask their provider how to dispute a label.

Reputation is a separate, opaque system

Labelling and blocking happen at the terminating side: the carrier serving the person you called, its analytics vendor, and sometimes an app or the handset maker. The US legal hook is 47 CFR § 64.1200(k)(3), which lets a terminating provider block "without liability" based on "reasonable analytics designed to identify unwanted calls" that "include consideration of caller ID authentication information where available", applied "in a non-discriminatory, competitively neutral manner", with an opt-out for the consumer.15

Read that carefully. Authentication is one input the analytics must "consider". Nothing in the rule says how much weight it carries, and nothing requires the provider or its vendor to publish the model. The rule even lets a provider "rely on Caller ID information to determine the purported originating number without regard to whether the call, in fact originated from that number".15

Hiya, one of the three companies behind the Free Caller Registry, describes the inputs: "Carriers use spam detection systems that analyze call patterns and customer behavior. Even legitimate businesses can be flagged if recipients frequently ignore or block calls, or if the calls are perceived as disruptive."28 And on whether registering stops labels: "Registration reduces the risk of spam or nuisance labels, but it doesn't completely prevent them. Carriers also consider how customers respond to your calls — if many people report or block your number, it can still be flagged."28

Carriers are equally careful. Verizon says it "automatically blocks in the network calls that we have determined are highly likely to be illegal based on reasonable analytics that incorporate caller ID authentication information", and uses STIR/SHAKEN to update its Call Filter algorithm, which "may, in some cases, reduce the chances of incorrectly blocking or identifying a 'good' call as 'Potential Spam.'"30 "May, in some cases" is as strong as any carrier gets on the record.

Our view: this opacity is partly defensible (publishing thresholds would teach robocallers to sit just under them) and partly a market failure, because the business harmed by a false positive has no way to see the evidence against it. The statute anticipated this, which is why the redress process below exists.

The name on the screen is a third system

"Spam Likely" complaints often come with a second one: the wrong business name, or none. That is CNAM (caller name) and it is not part of SHAKEN at all. As noted above, RFC 8224's check "does not cover the display-name portion of the From header field".1 The Free Caller Registry spells out the separation from the other side: "neither call protection providers nor their carrier partners use Registration Data to deliver Caller ID Name."27 Hiya likewise says its free registration "does not create a name or logo to appear on your outbound calls".28

A signed name is coming, slowly. RFC 9795 (July 2025) extends PASSporT to carry "rich metadata about a call and caller that can be signed and integrity protected", going "beyond human-readable display name".6 In December 2025 the FCC proposed "requiring terminating providers to transmit verified caller name or other caller identity information for presentation on a consumer's handset whenever they transmit an indication that a call has received an A-level attestation".20 Its stated reason supports this page's thesis directly: "consumers might mistakenly believe that a checkmark or other indication that a call received an A-level attestation is an assurance that a call is not a scam or otherwise unlawful."20 That is a proposal, not a rule; comments closed in early 2026.20

What forwarded calls look like

Many small businesses make few calls; they receive them and forward them to someone's mobile. Forwarding breaks a naive SHAKEN check: the signature covers the destination number, so when a call to your business number is retargeted to a staff mobile, the token's "dest" no longer matches. RFC 8946 (February 2021) was written for exactly this case, noting that "the original called party number is not always the number to which a call is delivered" and that the existing forwarding headers do not "provide any cryptographic assurance of secure redirection".5 It adds a "div" PASSporT so a forwarding provider can sign the diversion.5

Where that diversion signing is not supported, ATIS-1000074 tells the terminating verifier what to do: "If the canonicalized value of the Request-URI TN does not match the canonicalized value of the TN in the To header field, then the verifier shall skip verification, and treat this event as if no Identity header was received".4 A forwarding provider that receives a call with no Identity header should "perform authentication and add a SIP Identity header field".4

Put together, a forwarded business call reaches the mobile in one of three shapes:

1. The caller's number, with the original signature carried through. If the forwarding platform passes the original Identity header and diversion is signed, the mobile carrier can verify the original caller. Twilio's developer documentation, as one documented example, says calls forwarded with its <Dial> verb "can use the original caller ID by default", and that calls forwarded through its Calls API need the inbound call's CallToken, which "contains any SHAKEN/STIR and DIV" headers of the incoming call, to keep the caller ID and "facilitate SHAKEN/STIR verification".33
2. The caller's number, unverified. If the signature is dropped, or the verifier skips it because of the number mismatch, the mobile sees the original caller ID with no verification. The label, if any, reflects the reputation of the caller's number on the mobile carrier's analytics.
3. Your business number (or the platform's), as a new call. Some services present their own number so staff know it is a business call. That is a new origination, signed (if at all) by the platform's provider, and the mobile carrier judges the presented number's reputation, not the caller's.

The consequence that catches people out: in shapes 1 and 2, a "Spam Likely" on a forwarded call is a judgement about your customer's number, and nothing you register for your own number will change it. A customer phoning from a number with a poor reputation (a recycled mobile number, a hospital switchboard, a call-centre trunk) may be labelled on your staff's phones and go unanswered. Shape 3 trades that for a different risk: every forwarded call now carries one number's reputation. We would expect a busy forwarding number to look like a high-volume caller, though no vendor documents how it treats one.

There is no universally right shape. If you forward calls, test: ring your business line from mobiles on different carriers and note what each staff phone shows. Our article on testing forwarded calls, caller ID and voicemail gives a step-by-step method. For transparency: autoattendant.io sells a service built around this very pattern, an incoming business number forwarded to ordinary mobiles, and it uses shape 3: a forwarded call shows the business line's number on the team member's phone, not the caller's. Whichever vendor you use, run the test above on your own staff's phones, ours included.

What a small business can actually do

Roughly from most to least leverage:

1. Make sure your outbound calls can earn an A. Ask your provider in writing what attestation your calls receive and why. If you present a number your provider did not issue (say, your main line, held by another carrier, shown on calls from a dialler), the ATIS criteria give B unless the provider has "ascertained that the customer is authorized to use a TN".4 Ask how you can prove it. Under the 2025 rules, if a third party signs for your provider, your provider must still make "all attestation-level decisions".9
2. Check your provider is in the Robocall Mitigation Database and has not been removed. Anyone can search it,34 and a de-listed provider's traffic may not be accepted directly by others at all.13
3. Present one consistent number per purpose, the one customers have saved and call back on. Rotating numbers is what robocallers do, and the vendors say behaviour is what they score.28
4. Register your numbers, for free. The Free Caller Registry, run by First Orion, Hiya and TNS, takes business details, "call purpose" and "outbound calls per month", accepts US numbers only, and says outright that it "does not guarantee redress".27 Hiya's own Number Registration is also free; Hiya says verification usually takes about 24 hours and that changes then take "a few additional days" to propagate.28 Neither sets your displayed name.2728
5. Watch how recipients respond. Hiya says legitimate businesses get flagged "if recipients frequently ignore or block calls".28 Call people who expect you, and leave voicemails that identify you.
6. Dispute a label directly with the carrier where it appears. Verizon's feedback form says feedback "will be shared with our third party spam analytics provider" and warns "you should not assume the calls will no longer be blocked or labeled".29 TNS runs a feedback site with options for "My business number was blocked" and "My business number was mislabeled as spam".31 T-Mobile's equivalent is titled "Report Improperly Identified Calls".32 Keep dates, times and called numbers.
7. Use the legal redress rule if a carrier stalls. Every terminating provider that blocks calls "or utilizes caller ID authentication information in determining how to deliver calls" must publish "a single point of contact", "provide a status update within 24 hours", and, if it finds the treatment was wrong, "promptly cease the call treatment for that number", without charging the caller.15 Whether a label alone counts as "call treatment" is not spelled out; citing the section costs nothing.
8. For calls you receive, ask for the blocked-call list. A terminating provider that blocks under an opt-in or opt-out analytics programme must give the subscriber, free and "within 3 business days", a list of calls it blocked to that number "within the 28 days prior to the request".15 If customers say they called and you never saw it, this is how you find out.
9. Do not pay for authentication itself. A provider may not add a line-item charge to a small-business subscriber for the call authentication technology.14 Paid branded-calling and reputation-monitoring products are a separate, optional market.

The long-form articles go further on diagnosis: why a business number shows Spam Likely walks through testing on each carrier, why a business number shows up as spam collects the correction portals and the evidence to gather, and stopping spam calls to your business covers the inbound side.

What is changing, and what we expect

Four open FCC proceedings could change the answers on this page:

• Attestation rules. The July 2026 notice proposes "codifying attestation levels, defining improper attestations" and rules for verifying number-to-customer associations. The FCC says it does not believe a number association "can be established by a business agreement or certification that includes only a general statement" that the customer will use only numbers it is entitled to, which it calls "essentially the mechanism that Lingo Telecom used".22 Comments were due 10 August 2026, replies 8 September 2026.22
• Verified caller name. The December 2025 proposal to pair any A-level indicator with a verified name, possibly via Rich Call Data.20
• Non-IP authentication. The June 2025 proposal to require non-IP frameworks within two years.19
• Robocall Mitigation Database screening. The September 2026 proposal on who must file, screening of new filers and expedited removal; comments due 9 October 2026, replies 9 November 2026.23

Our view, and it is a forecast, not a finding: the direction is to make A mean something closer to "we know this customer and this number", and to attach a verified name to it. That helps businesses whose provider verifies them properly. It will not make labelling transparent: none of these proposals requires analytics vendors to publish their scoring. Even the FCC's question about prohibiting labels on A-attested calls is conditional on attestations first becoming trustworthy.22 For the foreseeable future, a business needs both a clean signature and a clean calling pattern, and should expect to manage the second through the vendors' own portals.

What we could not verify

• Which analytics vendor serves which carrier today. Carrier pages we read refer to an unnamed "third party spam analytics provider"29; vendor partnership announcements we found were years old. We have left the mapping out rather than repeat it from secondary sites.
• Labelling thresholds. No vendor publishes them; see above.
• A Canadian registration portal and a Canadian redress rule. Not found in the CRTC documents we read; we say so rather than infer one.
• Handset display. Which phones show a checkmark, "Verified", or nothing, varies by carrier, operating system and model, and changes with software updates. ATIS fixes only what the network sends (verstat), not what the screen shows.4
• The quoted attestation statistics come from parties to an FCC proceeding and are reported in the FCC's notice; we could not independently audit them.22

CRTC pages were read through Internet Archive copies, because crtc.gc.ca blocks automated readers. Every regulation is linked in the sources so you can check the current text yourself.