The deadline for U.S. carriers to introduce technology to fight call spoofing has now passed. As well as using the mandatory STIR/SHAKEN protocols, major carriers have introduced their own measures to combat robocalls. There’s still some way to go, however, particularly in implementing call blocking efforts and protecting the interests of legitimate callers.
The STIR/SHAKEN Requirements
The Federal Communications Commission set a June 30, 2021, deadline for U.S. carriers to implement STIR/SHAKEN. This set of protocols reduces cases of bogus callers spoofing caller ID details. Both technologies take particular aim at calls that use VoIP (Voice over Internet Protocol) systems. Traditionally, scammers were able to use VoIP systems to abuse caller ID technology.
STIR (Secure Telephony Identify Revisited) is a way for carriers to verify a caller’s ID. It uses a system similar to secure website certification. In addition, STIR provides a rating of how likely the caller is to be genuine. SHAKEN stand for Signature-based Handling of Asserted Information using toKENs. This is the way phone networks in the U.S. and Canada handle STIR data.
The mandatory implementation will force carriers to work together to exchange STIR/SHAKEN data. Therefore, making the system more effective for more calls. That’s why only carriers with fewer than 100,000 subscribers are exempt. This exemption is set to end in 2023, though that may be brought forward.
These measures intend to reliably say whether a caller’s stated identity is genuine. They aren’t meant to give any indication of the nature of the call. Third party call blocking apps currently work with carriers to label a call’s intent for consumers.
AT&T Call Blocking Efforts
AT&T says its is fully complying with STIR/SHAKEN, using it to verify calls made on its own network and across those from Verizon and T-Mobile. This helps to mitigate the ability for bad actors to engage in call spoofing efforts.
AT&T took advantage of an FTC ruling that says carriers can make robocall-blocking services available on an opt-out basis. That makes it easier to simply roll it out to everyone and then remove it where requested. Customers can then opt out individually if they feel it’s unnecessary.
With no mandate on whether or not to charge, ATT opted for a “freemium” model. The basic free service blocks calls suspected to be from fraudsters—for example, where it appears they are spoofing a number.
While a caller’s identity appears to be legitimate, it could still be an automated marketing call. The free service flags these instances for consumers. Users then decide whether to accept the call, block it, or send it to voicemail. AT&Ts premium service, costing $4 a month, sends suspected robocallers automatically to voicemail.
With STIR/SHAKEN in place, AT&T says the task remains a big one. It reports that in both 2020 and 2021, it has either blocked or labeled more than a billion robocalls each month.
Verizon Helps Smaller Carriers
Verizon has been using STIR/SHAKEN since last year and now reports blocking or labeling a total of 10 billion calls across 75 million users. It says it has reduced the number of spoofed calls to Verizon lines by at least 250 million a month, thanks partly to a “Honeypot” campaign. That involved creating dedicated phone lines specifically to attract and identify illegal callers.
In addition to exchanging information with AT&T and T-Mobile, Verizon is also dealing with smaller carriers. It says this adds up to 80% of the U.S. wireless market.
Not all of its work on call filtering has gone smoothly, however. Verizon tweaked its filter to automatically block any call from the customer’s own area code and send it to voicemail, unless the number is saved in their contacts.
The idea is to counter scammers who spoof a local number to increase the chance of the victim answering, but it risks blocking legitimate calls. To limit this disruption, users who spot a legitimate call being blocked can select an “Ignore Filter” button for that number.
T-Mobile Improves Caller ID
As well as beating the STIR/SHAKEN deadline and ditching a $2.99 fee for a call screening app, T-Mobile has taken technical steps to increase the chances that customers spot and answer genuine calls. It has implemented Rich Call Data (RCD) into its Caller ID, meaning users can see more information about verified callers.
The phone screen will continue to display the name and number of the caller along with a notice when the caller’s identity is verified. However, using RCD the user will also see a company logo and a brief description of the reason for the call. This content comes from the caller, but only displays after authentication of the STIR/SHAKEN identity token.
Troubles for Legitimate Businesses
Legitimate local callers aren’t the only ones who could face unintended consequences from STIR/SHAKEN. The major carriers have warned the way the rules apply to foreign calls could backfire.
An FCC ruling dubbed the “Foreign Provider Prohibition” says U.S. carriers cannot accept and relay calls from outside the country unless the foreign provider has registered with the Commission. This registration must include evidence of some form of robocall mitigation. This doesn’t have to mean using STIR/SHAKEN, but must involve a broadly similar approach.
According to the major carriers, the planned deadline of September 28 is too early as many legitimate foreign-based companies either don’t know about the rule or haven’t had time to complete the paperwork. That could mean legitimate callers who connect through international providers—for example, for financial reasons—could be blocked.
Monitor Your Reputation
The numbers show that call blocking efforts using STIR/SHAKEN are certainly benefiting phone users. However, when the technology and implementation prove overzealous and block or divert legitimate calls, it’s bad news for both caller and recipient. At Caller ID Reputation, we can help identify erroneous call labels or flags, helping you reach your customers reliably and without hurting your reputation.