STIR/SHAKEN Compliance Explained for Your Business

By Nicky Smith, Founder, Carolina Digital Phone  |  July 20, 2026  |  10 min read

A customer sees your business number on their phone. They recognize it, they answer, and your team gets the chance to help. If that same number shows up as Spam Likely, the call never gets that chance. Nobody tells you it happened, either. The phone just does not ring on the other end the way you think it does.

That is the practical reason people search for STIR/SHAKEN compliance explained. It is not curiosity about telecom regulation. It is a dental office in High Point wondering why appointment confirmations stopped getting answered, or a contractor whose crews cannot reach homeowners the morning after a storm. I have taken both of those calls. This article covers what the framework actually does, what it cannot fix, and the specific questions worth asking your phone provider.

What does STIR/SHAKEN compliance mean?

STIR/SHAKEN is a pair of technical standards. STIR stands for Secure Telephone Identity Revisited, and SHAKEN stands for Signature-based Handling of Asserted information using toKENs. Nobody remembers that. What matters is the job: when your business places an outbound call through a compliant provider, that provider attaches a digital signature confirming it has the right to send calls from your number. The carrier on the receiving end checks the signature before the phone rings.

The framework exists because of caller ID spoofing, where scammers place calls that display a number they do not own. Your number, maybe. Spoofing got so bad that Congress passed the TRACED Act in 2019, and the FCC now requires voice service providers to implement STIR/SHAKEN caller ID authentication on their IP networks. Providers must also certify their implementation status in the FCC's public Robocall Mitigation Database. Carriers are not allowed to accept traffic from providers that have not filed.

Notice who carries the legal obligation there. The carrier does, not you. Your business does not file anything with the FCC to be STIR/SHAKEN compliant. But the way you manage your outbound numbers directly affects how confidently your provider can vouch for your calls, and that is where attestation comes in.

How do attestation levels A, B, and C work?

STIR/SHAKEN does not stamp calls as good or bad. It attaches one of three attestation levels, which is the provider's formal statement of how much it knows about the call it is signing.

Most people never see an A, B, or C on their screen. The receiving carrier uses the attestation level alongside other signals, like call volume patterns and consumer complaints, when its analytics engine decides whether a call looks normal, suspicious, or worth blocking outright. A-level attestation will not guarantee your call gets answered. B or C attestation, though, gives those filters one more reason to be skeptical of you.

Worth knowing: the FCC has proposed pairing A-level attestation with verified caller name display, so that phones would show a confirmed business name on authenticated calls. The details are still moving, but the direction is clear. Full attestation is becoming the ticket to looking legitimate on a customer's screen.

Why is my business number showing as Spam Likely?

Here is the misunderstanding I run into most. An owner hears about STIR/SHAKEN, confirms their provider is compliant, and assumes the Spam Likely problem is solved. Then it happens again the next week.

Authentication confirms information about the calling number and the provider handling the call. It does not judge whether a customer wants the call, and it does not control the analytics engines that mobile carriers run on top of it. Those engines look at behavior. Unusually high call volume, lots of short calls, a burst of dials that nobody answers: all of it feeds a number's reputation score, and a legitimate business can trip those wires without doing anything wrong.

Think about what a normal week looks like around here. A roofing company in the Triad places sixty calls in one morning after a hailstorm. An insurance office calls every policyholder in a zip code after an ice event. A school district pushes out family notifications at 6 AM about a two-hour delay. Every one of those calls is wanted. To an algorithm watching raw call patterns, they can look like a robocall campaign.

So compliance is the floor, not the fix. If your number picks up a spam label, the path back usually runs through three things: confirming your calls carry A-level attestation, registering your numbers with the carrier analytics services that manage reputation, and adjusting calling patterns where you can. A provider with real engineers can walk you through all three. A provider with a ticket queue will tell you to wait and see.

What is your business actually responsible for?

You do not need to become a telecom lawyer. You need a tidy house. In practice that means one short list, reviewed a couple of times a year.

• Keep an inventory of every outbound number your organization uses. Main lines, direct dials, department numbers, and any number attached to appointment reminders, emergency notices, or automated calls.
• Use only numbers you own or are authorized to use. A number borrowed from an employee's personal cell, or held over from a former office location, undermines your attestation and confuses the people you are calling.
• Port carefully when you switch providers. A clean number port keeps your public-facing number under your control and eligible for full attestation. Get the port confirmed before the old service is disconnected.
• Set business caller ID for remote and mobile staff. A softphone app should present your approved business number on outbound calls. That protects employee privacy and keeps your identity consistent.
• Know what your vendors display. If an answering service, marketing agency, or notification platform places calls using your name, ask which number appears and who authorized it. This matters double for healthcare, financial services, and public agencies.

None of that is complicated. Most of it fits on one page in a drawer. The businesses that get burned are almost always the ones where nobody owns the list.

What should you ask your VoIP provider?

The right provider answers these plainly, on the phone, without routing you through three departments.

1. Do you sign my outbound calls with STIR/SHAKEN, and what attestation level do my numbers receive?
2. Are you certified in the FCC's Robocall Mitigation Database?
3. When I port numbers in or add a new location, how do you make sure those numbers keep full attestation?
4. If my number gets labeled Spam Likely, will you help me investigate it, and what does that process look like?
5. How do you handle caller ID for mobile apps and remote workers?
6. What is your process for registering my numbers with carrier analytics and branded caller ID services?

One caution on scope. STIR/SHAKEN is not HIPAA compliance, it is not E911 compliance, and it is not a records policy. A medical practice still needs safeguards around voicemail and texting. Schools and agencies still need location-aware emergency calling across buildings. Those deserve their own conversations, and a provider who serves those industries should be ready to have them.

A note from 45 years in this industry

How Carolina Digital Phone handles caller authentication

Carolina Digital Phone signs outbound calls with STIR/SHAKEN authentication and works to keep customer numbers at full A-level attestation, whether the numbers were issued by us or ported in from another carrier. We have been the trusted local source for telephone, business messaging, and AI Receptionist services in the Carolinas for more than 25 years, serving businesses, schools, and government agencies from our Greensboro headquarters with geo-redundant data centers in Greensboro, Research Triangle Park, and Dallas.

The part our customers actually notice is different, though. When a number picks up a spam label or calls stop completing to one mobile carrier, you call (336) 544-4000 and a North Carolina engineer picks up, checks the caller ID in use, reviews the call patterns, confirms number ownership, and works the problem upstream with the carriers involved. No provider can promise every mobile network will display every call identically. We can promise you will not be troubleshooting it alone.