What Is STIR/SHAKEN?

STIR/SHAKEN is the caller ID authentication framework used across the North American voice network. STIR (Secure Telephone Identity Revisited) is the set of standards; SHAKEN is the deployment profile that applies them to SIP networks. Together they allow an originating provider to cryptographically sign a call so downstream providers can verify that the calling number was legitimately used.

The moving parts

A participating provider obtains a Service Provider Code (SPC) token from the STI Policy Administrator, which establishes eligibility. Using that token it obtains a signing certificate. Calls it originates are then signed with an attestation level, and downstream providers verify the signature and may use the result in analytics, labelling, or blocking decisions.

The three attestation levels

Why implementation quality becomes visible

STIR/SHAKEN is unusual among compliance obligations in that the quality of your implementation is observable to your commercial counterparties. Carriers and analytics providers see your signing behaviour across large volumes of traffic. Weak onboarding controls, over-attestation, or inconsistent practice show up as a reputation signal long before they show up as a regulatory matter — and reputation signals affect whether your traffic completes.

Where providers commonly find themselves exposed

• Treating it as a one-time project. Certificates expire, tokens require renewal, and company records change.
• Stale upstream records. Eligibility depends on other records — OCN, RMD filing, 499 filer ID — and when those drift, renewal fails for reasons that are not obvious from the error.
• Over-attestation. The most common cause of reputation damage we are asked to repair.
• No documentation. When a carrier asks how attestation is determined, "our vendor handles it" is not an answer that resolves the conversation.

STIR/SHAKEN and robocall mitigation are separate obligations

Caller ID authentication is one requirement; maintaining and certifying a robocall mitigation program in the Robocall Mitigation Database is another. Providers regularly satisfy one and assume it covers the other. It does not — and the RMD entry is the more externally visible of the two.

EquiTel handles registration, remediation, and reputation recovery as STIR/SHAKEN practice work.

Frequently Asked Questions