STIR/SHAKEN Doesn't Stop Spam Likely Labels

What the protocol actually checks

STIR/SHAKEN is a caller ID authentication protocol the FCC required voice providers to roll out between 2021 and 2023, and by now it should already be running on the network behind whatever business phone system a company uses. What it verifies is narrow: that the number showing up on a recipient's screen actually traces back to the carrier that originated the call, not that the caller is trustworthy or that the call itself is legitimate. A phone system can pass STIR/SHAKEN with the highest attestation grade and still have its calls labeled Spam Likely, because a separate set of carrier analytics engines, not the authentication protocol, decides that label. Buying a VoIP or cloud phone system means checking both systems, not assuming one covers the other.

The name comes from two overlapping technical efforts: STIR (Secure Telephony Identity Revisited), a set of protocols an IETF working group built for authenticating caller ID, and SHAKEN (Signature-based Handling of Asserted information using toKENs), the implementation specification ATIS and the SIP Forum produced so carriers apply those protocols consistently [FCC, Third Further Notice of Proposed Rulemaking, WC Docket No. 17-97, released 2021-04-29]. In practice, the originating carrier cryptographically signs each outbound call with one of three attestation levels, and the terminating carrier checks that signature before the call reaches a phone.

A-level, or full attestation, means the originating carrier has verified both where the call is coming from and that the caller is authorized to use that specific number. B-level, or partial attestation, means the carrier can confirm the call originated on its own network but cannot confirm the caller has the right to use that number, the situation for calls routed through some reseller or unregistered VoIP accounts. C-level, or gateway attestation, is the weakest signal: the carrier can only confirm it received the call and passed it along, with no way to verify where it actually originated, typically international calls entering the U.S. network through a gateway carrier [TransUnion; TelcoBridges, cross-referenced, accessed 2026-09-10].

Implementation deadlines and provider scope

The main STIR/SHAKEN implementation deadline for voice service providers was June 30, 2021, with extensions for specified provider categories. Small providers with 100,000 or fewer subscriber lines initially had until June 30, 2023. The FCC subsequently shortened the extension for non-facilities-based small providers to June 30, 2022; enforcement-identified providers originating suspected illegal robocalls could face an earlier deadline [FCC Fourth Report and Order, FCC 21-122, accessed 2026-10-11].

Compliance runs through a separate filing, the Robocall Mitigation Database (RMD), which the FCC launched in April 2021. Every voice provider, whether it had implemented STIR/SHAKEN or was still working through robocall mitigation steps of its own, had to certify its status there by June 30, 2021. Beginning September 28, 2021, any provider whose certification did not appear in the database could no longer have its traffic accepted directly by other voice providers, which effectively cut unregistered carriers off from the rest of the phone network [FCC News, 2021-06-30].

For a business buying a VoIP or cloud phone system in 2026, those historical dates do not prove a particular provider is compliant today. Check its current RMD certification and the attestation level it gives your calls, including any customer registration requirements. The FCC adopted the shortened small-provider deadlines in its 2021 final order; the earlier proposal is insufficient evidence of the final requirements [FCC 21-122, accessed 2026-10-11].

Full attestation doesn't mean 'not spam'

STIR/SHAKEN and the 'Spam Likely' label a phone shows are two different systems built by two different sets of companies. Attestation is cryptographic and carrier-side; the spam label comes from analytics engines run by companies like Hiya, First Orion, and Transaction Network Services, the three firms that jointly built the industry's original Free Caller Registry, a database business numbers can register in specifically to reduce false spam flagging [Hiya company blog, 'What Is Free Caller Registry and What Does It Do?,' accessed 2026-09-10]. Those analytics models watch calling behavior, not signatures: an unusually fast dial rate, a burst of short-duration calls, or a spike in recipient block-and-report actions can get a fully A-attested number flagged anyway [3Tree Technology; Aloware, cross-referenced, accessed 2026-09-10].

The FCC said as much the day it announced broad implementation: "While STIR/SHAKEN will improve the quality of caller ID information, it does not mean the call itself is legitimate... This improved information will help verify the phone number from which the call was made, or flag that it is not verified, and help blocking services both at the consumer level and before the call reaches the consumer" [FCC News, 2021-06-30]. That second half is the part a buyer needs: STIR/SHAKEN feeds the blocking and labeling systems as one input, it isn't the labeling system itself.

Hiya launched its own free registration tool, Hiya Number Registration, on July 31, 2024, positioned as a superset of Free Caller Registry that adds self-service status checks and management, since the older registry gives businesses no confirmation their submission actually went through or stayed current [Hiya company blog, accessed 2026-09-10]. Either registry runs independently of whatever attestation level a phone system vendor delivers, which means the two are worth treating as separate line items when evaluating a provider, not one.

What vendors actually do differently

How much of this a vendor actually handles varies more than most pricing pages let on. RingCentral says its system signs every call that originates on its network and has filed its STIR/SHAKEN certification in the FCC database, adding that there's no action required on the customer's part for calls to be attested [ringcentral.com blog, 'STIR/SHAKEN: How We Drastically Reduce Robocalls,' updated 2025-03-13]. OpenPhone, rebranded to Quo, ties full attestation to a business-registration step it runs on the customer's behalf: any workspace that completes carrier registration through Quo gets A-level attestation, and the company says it proactively emails high-volume outbound callers to prompt that registration rather than waiting for a spam complaint [quo.com blog, 'STIR/SHAKEN: How New FCC Protocols Can Affect High Volume Outbound Callers,' published 2025-07-21].

JustCall draws the clearest line between the two outcomes. Its own help center states that a number without completed Business Profile and STIR/SHAKEN registration in its Compliance Center "will receive B-level (Partial) Attestation," and that this "frequently causes carriers to flag your calls as Spam Likely or Scam Likely," explicitly noting the registration is not legally required by the FCC but is recommended by the vendor itself [help.justcall.io, 'Avoid Spam on Your JustCall Numbers,' accessed 2026-09-10]. The call still connects either way, B-level attestation isn't a block, it just carries a weaker signal that carrier analytics engines read as reason for suspicion. A team that skips that registration step because a sales page said 'STIR/SHAKEN compliant' can end up running an outbound campaign on B-level numbers without realizing it.

Maintaining number reputation after registration

Registration requirements and number reputation are separate: even an A-attested number needs ongoing attention to calling behavior. Quo and JustCall publish overlapping guidance on this, and the overlap itself is a useful signal that these aren't vendor-specific quirks. Ramp a new number's outbound volume gradually instead of hitting full campaign volume on day one, since a sudden spike from zero to high volume is one of the behaviors analytics engines watch for regardless of attestation level [quo.com blog, 2025-07-21; help.justcall.io, accessed 2026-09-10]. Keep calling lists current and remove numbers that never connect, since low answer and completion rates feed the same reputation models. Avoid using local-prefix numbers that match a destination area code across a large call list, a pattern both companies flag as neighbor spoofing that carriers monitor closely because scammers rely on it too.

Debt-collection frequency limits have a defined scope. Under the CFPB debt-collection rule, a collector is generally presumed to violate the rule by placing more than seven calls within seven consecutive days to a particular person about a particular debt, or by calling within seven days after a telephone conversation about that debt, subject to exceptions. That is not a general eight-call ceiling for every outbound business [CFPB Debt Collection Rule FAQ, accessed 2026-10-11]. For a recorded call, check the call recording consent requirements. For consumer telemarketing covered by the TSR, the 3% abandonment rate is one condition of the abandoned-call safe harbor; it does not apply to every outbound call [FTC, Complying with the Telemarketing Sales Rule, accessed 2026-10-11].

FAQ