June 8, 2022

Did STIR/SHAKEN’s Implementation Effectively Stop Call Spoofing?

STIR/SHAKEN was developed to prevent call spoofing, one of the most successful techniques criminals use to commit fraud. So, has STIR/SHAKEN reached its goal? The answer is somewhat complicated: STIR/SHAKEN has helped to reduce instances of call spoofing, but scam calls still reach victims.

Scam Calls Are Still Rampant

Call spoofing happens when someone intentionally falsifies the information that appears on a recipient’s caller ID display. For example, a scammer might spoof a trusted organization’s phone number and display information to reach victims more easily.

You might already know this. Many consumers, however, don’t distinguish between call spoofing and other types of scam calls. From their perspective, robocalls, spam calls, and call spoofing might all fall under the same category.

A Consumer’s Perspective

Unfortunately, scam calls are still rampant after implementing STIR/SHAKEN. This technology stops a lot of call spoofing attempts, but consumers don’t always realize the positive impact because they still receive scam calls.

Also, the average person can’t know when STIR/SHAKEN stops unwanted calls from spoofed numbers. STIR/SHAKEN implementation might stop nine out of 10 calls from spoofed numbers. But as long as consumers feel annoyed, many will assume the system doesn’t work.

Attestation’s Role in Stopping Call Spoofing

Ultimately, STIR/SHAKEN will stop call spoofing by verifying all call origins. By verifying a call’s origin, carriers and analytics engines can determine whether someone is attempting to spoof a legitimate number. Much of the process relies on attestation ratings.

There are three attestation ratings:

Full Attestation (A) applies to calls when the service provider can fully authenticate the call origin and check private and public keys stored in repositories.
Partial Attestation (B) applies to calls when the service provider can authenticate the number but cannot verify that its owner is the person or company using it.
Gateway Attestation (C) applies to calls when the service provider can authenticate the origin but cannot identify the source. This rating often applies to calls coming from outside of the U.S.

Attestation ratings from STIR/SHAKEN implementation aren’t the same as call labels and warnings that carriers and third-party apps apply to some numbers. Warnings like “Potential Fraud” and “Scam” come from two sources:

Analytics Engines (AE): Carriers that use analytics to identify robocallers and other problematic dialers.
Consumer Reports: Reports from consumers who have been bothered by robocalls, scams, and similar annoyances.

Attestation ratings, call labels, and warning labels have helped stop many inauthentic calls, but they have not managed to stop all of them.

Call Spoofing Still Occurs

Again, STIR/SHAKEN’s implementation has not stopped all call spoofing. To prove this, the company Pindrop gathered solid evidence that call spoofing still happens. Its findings show that:

64%-76% of calls don’t have any attestation ratings.
About 48.4 million calls without attestation received “Green” scores. (In the attestation system used by Pindrop, “Green” equals an A rating.)
Almost 300,000 calls with C attestation ratings were given “Green” scores.
More than 117,000 calls assigned A attestation ratings presented spoofing risks that contributed to their “Red” scores. (“Red” scores roughly equal C ratings.)

This data makes it clear that STIR/SHAKEN implementation still has a long way to go before it can stop call spoofing.

Is STIR/SHAKEN Implementation Effective?

STIR/SHAKEN implementation has the potential to stop call spoofing. So far, though, it has not met that goal. Consumers still receive millions of unwanted scam calls, and businesses still suffer from scammers who spoof their numbers.

The industry must acknowledge the challenges before it can make STIR/SHAKEN more effective.

Challenges to Implementation

Not every carrier has adopted the STIR/SHAKEN framework. Currently, that’s the biggest barrier to success. STIR/SHAKEN relies on cooperation from every service provider. Without full cooperation, the system cannot generate all of the documents needed to verify numbers and owners.

Federal regulations required every phone carrier to implement STIR/SHAKEN by June 30, 2021. On February 17, 2022, the FCC reported two companies, Bandwidth Inc. and Vonage Holdings, for failing to meet the deadline.

The FCC recognizes the severity of this issue and is paying close attention to whether companies adopt the framework correctly. FCC Chairperson Jessica Rosenworcel has even stated that the agency “will not turn a blind eye to providers that have not done enough to protect consumers from spoofed robocalls.” She also promises that the FCC “will hold companies accountable if they fail to meet their commitments to protect consumers from robocalls.”

The good news is that most carriers have committed to STIR/SHAKEN implementation. Until everyone joins, though, the framework can’t solve the problem.

Brands Still Need To Monitor Number Reputations

Call spoofing damages brands and discourages consumers from answering phone calls. Unfortunately, you can’t expect STIR/SHAKEN implementation to effectively stop call spoofing until every carrier adopts the framework. It’s impossible to know when that will happen, even with the FCC pressuring companies like Bandwidth and Vonage to meet requirements.

Monitoring your number reputations can help you connect with more leads and customers. Reliable monitoring could even help you identify numbers that criminals have spoofed. When you see numbers get blocked or labeled, you know something has contributed to them earning negative reputations.

Caller ID Reputation makes it easy for you to monitor all of your numbers. You will receive alerts when numbers receive labels, blocks, or warnings. You will even get screenshots that show you what appears on smartphone screens when you place calls.

Start a free trial to see how Caller ID Reputation can improve number reputations and outreach efforts.