August 23, 2023

STIR/SHAKEN: What it is & its role in fighting robocalls

STIR/SHAKEN: What it is & its role in fighting robocalls

STIR/SHAKEN (STIR: Secure Telephone Identity Revisited; SHAKEN: Signature-based Handling of Asserted Information Using toKENs) might sound like something from an old James Bond movie (after all, that’s where the idea came from), but it's one of the most important developments in robocall history. In simple terms, STIR/SHAKEN is a framework of protocols designed to prevent neighbor spoofing, a technique robocallers use to conceal their identities. The goal is to ensure caller ID information is reliable and accurate, even across multiple phone networks.

However, despite the government announcing the STIR/SHAKEN framework several years ago, we're only just beginning to see its effects — and so far, they haven’t been game-changing. Scammers are still stealing personal information like login credentials, Social Security numbers, and bank account details, getting away with tens of billions of dollars every year.

This guide will answer the following questions:

  • How does STIR/SHAKEN work?
  • Has the STIR/SHAKEN implementation been effective in stopping robocalls?
  • In addition to STIR/SHAKEN compliance, what else can we do to stop robocalls?


STIR/SHAKEN is a combination of protocols and standards that allow phone companies to verify caller ID information as a call moves from caller to recipient. STIR is the protocol for digitally signing (authenticating) caller ID information so the recipient knows who’s trying to reach them. SHAKEN is the framework, or the way STIR is implemented across voice service providers.

Spam and scam calls have become a massive problem in the United States. These calls are more than just annoying; they’re dangerous. Here are some facts you should know:

  • The Federal Communications Commission (FCC) receives more complaints about robocalls than anything else.
  • Americans received 31 billion robocalls during the first half of 2023 and more than 78 billion robocalls in 2022.
  • This led to an estimated $33 billion in losses during the first half of 2023 and over $65 billion in losses during 2022.
  • Robocalls are almost always illegal.
  • Robocallers may claim to be from the IRS, immigration services, and other government agencies; some may even pretend to be law enforcement.
  • Some robocallers spoof their numbers to make you think they are calling from a local number.
  • Robocallers may try to steal your personal data and financial information.

Fraudulent robocalls have been around since the '90s, but they’ve become an increasingly serious issue in recent years. As a result, the government took action to fight the problem.

How does STIR/SHAKEN work?

In 2016, the FCC created the Robocall Strike Force to explore new ways to identify spam callers and combat scams, as well as provide people with more information about calls from unknown numbers. Eventually, the FCC followed up with a new protocol called STIR/SHAKEN. Here’s the simple version of how it works:

  • Every time someone calls your phone, STIR/SHAKEN tries to identify the origin of the caller.
  • If the caller might be a scammer, you should receive a message saying "scam likely" or "spam likely" on your caller ID.

For a closer look, here’s an overview of how STIR/SHAKEN is intended to work.

1. A call is placed

Someone dials a phone number, sending the originating service provider (the caller’s carrier) a SIP (Session Initiation Protocol) INVITE, or a request to initiate a call.

2. The caller’s phone carrier assigns an attestation level and adds certificate information

The originating service provider adds information like the caller’s number, the originating network, the attestation level of the call, and how confident they are that the caller’s original source matches the phone number’s owner. The provider also adds an encrypted digital certificate of authentication.

3. The recipient’s phone carrier receives the SIP INVITE

The terminating service provider, or the phone carrier of the recipient of the phone call, receives the SIP INVITE with the added information from the originating carrier. Even if the call goes through intermediate networks, the information from the originating provider remains unchanged.

4. The recipient’s phone carrier sends the information to be verified

After receiving the SIP INVITE and its added information, the call recipient’s phone carrier sends the SIP information to be confirmed by a STIR/SHAKEN verification service.

5. The verification service confirms the information and returns it to the terminating provider

Using certificate repositories, the verification service checks the digital signature in the SIP information to confirm the call is legitimate. The service then sends the information back to the recipient’s phone carrier.

6. The call goes through to the recipient with accurate caller ID information

With the call authenticated and verified along the way, the intended recipient receives the phone call with accurate caller ID information.

Free 7 day trial
Fight back against spam and reclaim your phone.
You’re one step away from a spam-free phone.
Get Started

Role of government regulations in combating robocalls

STIR/SHAKEN won't work without the widespread cooperation of phone carriers like Verizon, T-Mobile, and AT&T, who all need to implement the protocol for it to operate effectively. Unfortunately, STIR/SHAKEN costs money to execute, making some telephone service providers hesitant to comply with the framework. This is why the government introduced new legislation to make carriers adopt the STIR/SHAKEN protocol.

In 2019, the newly signed TRACED Act mandated that carriers implement call authentication technologies (like STIR/SHAKEN) and a robocall mitigation program or face penalties for non-compliance. Deadlines for different types of phone carriers varied, however, and the final deadline wasn’t until June 2023. Unfortunately, these staggered deadlines may be one reason STIR/SHAKEN’s full effect still remains to be seen.

Limitations of STIR/SHAKEN

STIR/SHAKEN aims to help restore consumer trust in caller ID information by preventing phone number spoofing, but it can’t stop spam calls or punish scammers.

Unfortunately, STIR/SHAKEN comes with a few limitations:

  • Many spam and scam calls originate from outside the United States, and American laws don’t intimidate fraudsters from overseas — the government has no jurisdiction over scammers outside the country.
  • Scammers can be crafty, often using the latest technology and frequently changing their phone numbers, making them difficult to trace.
  • Sometimes legitimate businesses might be erroneously flagged as spam, and it could take some time to perfect the process.

While the STIR/SHAKEN framework is a step in the right direction, it's not an all-encompassing solution. That’s why it’s important for consumers to know about the additional steps they can take to protect themselves.

Other robocall-blocking solutions

Although STIR/SHAKEN has provided a much-needed framework for unifying our efforts against spam, it’s not a complete solution on its own. However, there are additional steps you can take to keep robocalls from spamming your phone.

Joining the Do Not Call Registry

The National Do Not Call Registry is a database of phone numbers that legitimate telemarketers are restricted from contacting. Unfortunately, the Do Not Call Registry only prevents legal, legitimate calls from telemarketers and not the illegal robocalls that try to steal your money.

Removing your number from the Internet 

There are many ways scammers can get your number, from buying stolen data off the dark web to simply browsing the Internet. Removing your telephone number from social media accounts and online profiles makes you less susceptible to robocalls. If you own a business, use a separate line for your listing.

Talking to your carrier 

Reporting spam texts, scam attempts, and robocalls to your phone service provider alerts the company to the severity of the issue and may help prevent the same phone numbers from harassing others in the future. If your carrier is not STIR/SHAKEN compliant, however, they can’t effectively prevent caller ID spoofing.

Contacting the police 

If you’ve lost money to a scammer over the phone, you should report the problem to your local police department. However, even if they can help you get your money back, this won't stop illegal robocallers from contacting you in the future.

The unfortunate reality is that none of these options are foolproof. Even if you use all of the above methods, chances are you’ll still receive robocalls. However, with the right technology, you can take back your privacy and make robocalls a thing of the past.

How to fill STIR/SHAKEN robocall blocking gaps

While inconsistent deadlines and lack of cohesion may have prevented government programs like STIR/SHAKEN from eliminating the problem altogether to this point, there are other ways to crack down on unwanted spam calls and texts from the user side. A dedicated spam-blocker app can eliminate these nuisances using cutting-edge technology and user feedback.

Audio fingerprinting 

An audio fingerprint is like a regular fingerprint, but for a person’s voice. Spam-blocking apps that use this technology can detect voice patterns and common phrases used by robocallers, creating an audio ID that can be attributed to the spammers themselves — not just their current phone numbers. 

When a company identifies a spammer or scam caller by their audio fingerprint, it adds the number they’re calling from to a universal database, preventing the caller from harassing anyone else. This is one of the most effective ways to reduce the robocall problem.

Third-party spam blocker apps

Third-party spam-blocking apps use predictive algorithms, global research, and user feedback to identify and block spammers, preventing harmful and annoying calls from reaching your phone in the first place. Not all spam-blocking apps are equally effective, however, so it’s important to choose the spam blocker that offers the most critical features and comprehensive protection from scams.

Live life spam-call-free®
Sign up for a 7-day free trial

Why Robokiller is the best solution for spam calls

A third-party spam blocker is a necessity in the fight against spam, and choosing the right one is a must. Robokiller comes with crucial features that work alongside STIR/SHAKEN technology to help block unwanted calls and shut down spam. These features include:

  • Real-time spam call protection
  • SMS protection that fends off 99% of spam text messages
  • Personalized block and allow lists
  • Audio fingerprinting
  • Answer Bots that intercept scam calls and waste scammers’ time

Final word

STIR/SHAKEN provides some welcome relief in the battle against robocalls. However, the framework has its limitations. Although it improves caller ID reliability and makes things difficult for robocallers, it hasn’t scared away scammers altogether. With the final STIR/SHAKEN deadline passing, we will see if more consistent, unified efforts have a more substantial impact on the spam problem. Until then, Robokiller can help you live spam-call-free™.

‍Click here to try Robokiller for free for 7 days today!


What does STIR/SHAKEN mean? 

STIR/SHAKEN stands for Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted Information Using toKENs (SHAKEN). Put simply, it’s a framework of connected standards between different voice service providers that authenticates or “signs” phone numbers as legitimate. STIR/SHAKEN seeks to fight neighbor spoofing by ensuring that caller ID information is verified before calls can reach their targets.

What is the STIR/SHAKEN certificate?

A STIR/SHAKEN certificate is essentially confirmation that a call has been verified. These digital certifications allow voice providers to verify that the person placing the call is, in fact, who they say they are, not a potential scammer using neighbor spoofing to disguise their identity.

How does the STIR/SHAKEN protocol work?

When someone calls your phone, STIR/SHAKEN attempts to identify the origin of the call — if the call is a possible scam, you’ll receive a warning on your caller ID. Using this information, you can decide to answer the call, reject it, block the number, or (depending on your carrier) send the call to voicemail.

Does STIR/SHAKEN work?

While the STIR/SHAKEN protocol does represent a step toward actively fighting the spam problem, it’s not a complete strategy. It depends on not only national but worldwide cooperation, and it may take some time to become fully effective. STIR/SHAKEN may be more productive than the public realizes, however, as customers are generally unaware of the spam calls they don’t receive as a result of the framework.

When did STIR/SHAKEN start? 

An early version of STIR/SHAKEN was introduced to the public in 2019, but its various deadlines have made for a less-than-cohesive effort nationwide. As all voice service providers finally settle into the framework, we hope a more unified response leads to a more significant reduction in spam calls. Fortunately, you can still use spam-blocking apps like Robokiller to keep yourself safe from spam and scams.

Does STIR/SHAKEN work with foreign calls?

STIR/SHAKEN is designed to help voice networks identify the source of illegal calls and assist agencies such as the FCC in shutting them down. However, holding accountable scammers from abroad is difficult — United States laws aren’t likely to dissuade fraudsters outside of its jurisdiction.

Free 7 day trial
Fight back against spam and reclaim your phone.
You’re one step away from a spam-free phone (and a little poetic justice, thanks to Answer Bots).
Sign up for a 7-day free trial

Featured articles

American Solar scam calls and how to avoid them
January 24, 2024
American Solar scam calls and how to avoid them
Read more
arrow right
Data protection in the digital age: Why it's so important
January 24, 2024
Data protection in the digital age: Why it's so important
Read more
arrow right
How to protect yourself from a cyber attack
January 24, 2024
How to protect yourself from a cyber attack
Read more
arrow right