What is STIR/SHAKEN?

What is STIR/SHAKEN?

STIR (Secure Telephone Identity Revisited) is a set of internet standards for signing caller ID; SHAKEN (Signature-based Handling of Asserted information using toKENs) is the telecom industry’s framework for deploying them. Under the TRACED Act, the FCC required most US voice providers to implement it in their IP networks by June 30, 2021, with extensions for some smaller providers (FCC: combating spoofed robocalls with caller ID authentication).

The signature carries one of three attestation levels. A (full): the provider knows the customer and has verified they may use the number. B (partial): the provider knows the customer but cannot verify the number. C (gateway): the provider is passing the call along from a source it cannot authenticate, such as an international gateway.

Attestation is not a spam score. It tells the receiving carrier that the caller ID is genuine; carriers and their analytics engines still decide labels like Spam Likely from how a number behaves. On some networks, a call with full attestation can show a Caller Verified indicator.

On Twilio, the level depends on how far your registration goes. With an approved Business Profile and SHAKEN/STIR Trust Product, and your numbers assigned to both, calls are signed A. With the profile and Trust Product approved but a number left unassigned, calls from that number are signed B, and with no approved registration at all, Twilio signs them C (Twilio’s SHAKEN/STIR docs).

Common mistakes. Registering the business but never assigning the numbers, which leaves calls at B. Buying new local numbers later and forgetting to add them to the profile and the Trust Product. And confusing attestation with the caller ID name: STIR/SHAKEN signs the number, while CNAM and branded calling are what put a name on screen.

How does STIR/SHAKEN sign a call?

The originating provider builds a small signed token, called a PASSporT, and sends it with the call in the SIP Identity header. The token is defined in RFC 8225, the header in RFC 8224, and the SHAKEN fields in RFC 8588; ATIS publishes the industry framework as ATIS-1000074 (ATIS standards list).

The terminating provider downloads the certificate named in the token, checks the signature, compares the numbers in the token with the numbers on the call, and passes a verification result on toward the phone. If anything fails to match, the call still connects, but without a verified result.

• attest: the level, A, B or C.
• orig and dest: the calling and called numbers.
• iat: when the token was issued, so an old signature cannot be replayed.
• origid: an identifier for where the call entered the network, useful for tracing.

What do A, B and C attestation mean for a sales team?

For a team calling from Twilio numbers, A is the level to aim for, and B or C usually means a registration step was skipped. Take a team of four reps calling from six numbers: one per rep, a default number and one local number. It registers its Business Profile and SHAKEN/STIR Trust Product, but assigns only the four rep lines. Calls from those four go out at A; calls from the default and local numbers go out at B, even though they belong to the same business.

The fix is to assign the last two numbers in Trust Hub, which costs nothing extra. Each US local number is $1.15 a month at Twilio’s published rate (Twilio voice pricing), and the attestation comes with it once the number is assigned.

What does the law require, and of whom?

The obligation sits with voice providers, not with the businesses that make calls. FCC rules in 47 CFR 64.6301 require providers to sign and verify calls on their IP networks, and the TRACED Act set the deadline. A business calling through Twilio does not sign anything itself; it registers with Twilio so Twilio can sign its calls at A.

Callers still have caller ID duties of their own. Telemarketers must transmit a number that can be called back during business hours (47 CFR 64.1601), and showing a number with intent to defraud or cause harm is illegal spoofing whether or not the call is signed. This is general information, not legal advice.

Setting up full attestation on Twilio

Do these in the Twilio Console, in order, then check the result before a campaign starts.

• In Trust Hub, create a Business Profile with your legal business details and wait for approval.
• Create a SHAKEN/STIR Trust Product linked to that profile and wait for approval.
• Assign every number your reps call from to both the profile and the Trust Product.
• Place a test call from each number to a second Twilio number and read StirVerstat on the incoming webhook.
• Repeat the assignment whenever you buy a number, since new numbers are not added for you.

STIR/SHAKEN in Rapidialer

Rapidialer places calls through your own Twilio account, so they carry the attestation Twilio gives your numbers. Twilio gives full A attestation to numbers registered to an approved Business Profile and SHAKEN/STIR Trust Product in its Trust Hub (Twilio’s SHAKEN/STIR docs). Rapidialer does not register anything in Trust Hub for you; you do that in the Twilio Console. Whichever caller ID a call uses, whether the rep’s line, your default number or a local presence number, carries that number’s own attestation, so register all of them.

Related terms

• CNAMThe caller ID name shown with a phone number, looked up by the receiving carrier.
• Local presence dialingShowing a caller ID with the same area code as the person being called.

STIR/SHAKEN: questions and answers