Question: What is STIR/SHAKEN?

Answer:

The acronyms, which stand for Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted Information Using toKENs (SHAKEN), refer to a set of interrelated standards intended to reduce fraudulent robocalls and caller-ID spoofing in the US and Canada. (Spoofing is the practice of displaying false caller-ID information, often in an illegal attempt to trick the recipient into answering.) While reducing (but not eliminating) potential scam calls, these protocols are also intended to help ensure legitimate calls can be processed through carrier networks unhampered.

The standards require that each call originated by a telephone service provider be digitally “signed” to indicate the caller’s right to use the telephone number. If the call is handed off to a different company, the terminating carrier checks to see if the “signature” is authentic before the call and its associated caller-ID are delivered to the recipient. There are 3 levels of attestation:

  • Full attestation, level A, indicates the service provider recognizes the entire telephone number and authenticates the call as coming from the authorized subscriber of the number.
  • Partial attestation, level B, means the origination of the call has been authenticated, however the telephone service provider cannot verify the whole telephone number (e.g., an extension of a business’s public branch exchange (PBX)).
  • Gateway attestation, level C, verifies that the call came through a known gateway or service provider (e.g., an international call); however, further authentication is not possible.

The Federal Communications Commission (FCC) required service providers in the US to implement STIR/SHAKEN in the Internet Protocol (IP) portions of their network by June 30, 2021, and to develop a mitigation solution for non-IP functionality by the same date. (The Canadian Radio-television and Telecommunications Commission has extended the compliance deadline in Canada to November 30, 2021.) While many calls will be identified and stopped, STIR/SHAKEN does not block calls, per se. However, it is intended to significantly boost call recipients’ confidence in the legitimacy of the inbound calls they receive.