A phone call can appear legitimate, display a familiar number and still be part of a carefully planned fraud attempt. As criminals combine caller ID spoofing with automation and AI-generated voices, telecom providers must reconsider whether traditional security controls can protect modern voice networks.
For years, operators have relied on caller ID screening, number blacklists, call-volume monitoring and basic fraud detection to identify suspicious activity. These controls remain useful but the threat landscape has changed. Modern voice fraud can move faster than static rules and exploit weaknesses across interconnected networks. Preventing it now requires stronger identity verification and a layered security strategy.
Why Traditional Telecom Security Is Reaching Its Limits
Traditional telecom security was designed to detect familiar patterns: unusual call volumes, repeated calls from known suspicious numbers or activity that differs from normal traffic. These methods can identify many threats but they are less effective when attackers constantly change their techniques.
The weakness of number-based screening
A blacklist works when a fraudulent number is already identified. However fraudsters can rotate numbers, spoof legitimate caller IDs or use compromised accounts to make calls appear more credible. A number-based system may therefore recognise yesterday’s threat while missing a new one.
Consider a fraudster who spoofs the number of a bank. A recipient may see a familiar caller ID and assume the call is genuine. Traditional screening that focuses primarily on the displayed number may not establish whether the caller is authorised to use it.
Static rules cannot understand every new pattern
Call-volume thresholds and fixed detection rules can flag suspicious activity but they can also create false positives. A legitimate business running a large customer-support campaign may generate high call volumes while a carefully distributed fraud campaign may stay below a simple threshold.
Traditional controls are not obsolete. Their limitation is that they cannot independently establish caller identity or detect every form of deception.
Modern Voice Fraud Uses More Than Caller ID Spoofing
Voice fraud has expanded beyond basic number manipulation. Criminals can combine social engineering, automated calling and synthetic audio to make fraudulent conversations more convincing.
AI-generated voices increase the risk
Voice cloning tools can imitate a person's voice using audio samples. This creates opportunities for impersonation scams involving executives, family members, financial institutions or customer-support representatives.
Hiya's 2025 research analysed 8,455 calls captured through its honeypot system and found that 25% contained AI-generated audio. Of those AI-generated calls, 55% were identified as fraud. The findings illustrate why voice security can no longer focus only on the telephone number displayed on a screen.
Social engineering exploits human trust
A caller may claim to be from a bank's fraud department or a company's IT team and create urgency to persuade the recipient to reveal sensitive information or approve a transaction. Even when a network can authenticate the calling number, it cannot automatically determine whether the caller's request is honest.
This distinction matters: Caller authentication helps establish whether a number is authorised for use. It does not prove that the person speaking is trustworthy or that the purpose of the call is legitimate.
STIR/SHAKEN Adds a Stronger Layer of Caller Identity Verification
STIR/SHAKEN addresses a major weakness in traditional caller ID systems by using digital certificates and cryptographic signatures to authenticate calling numbers.
How call authentication works
The originating service provider checks the caller's authority to use a telephone number and creates a signed identity token for the call. The receiving provider can then verify that signature using the relevant certificate.
The framework also supports attestation levels:
A – Full Attestation: The provider knows the customer and has verified the customer's authority to use the calling number.
B – Partial Attestation: The provider knows the customer but cannot fully verify the customer's authority to use the number.
C – Gateway Attestation: The provider is handling the call as a gateway and cannot attest to the caller's identity in the same way.
These levels provide useful context for call handling. They are not a universal fraud score and should not be treated as proof that a conversation is safe.
Why certificates and private keys matter
Digital certificates connect a service provider's identity to the cryptographic credentials used for call signing. Private keys are essential because they are used to generate the signatures that receiving networks verify.
If certificate issuance, renewal, storage or key handling is poorly managed the authentication process can become unreliable. Certificate lifecycle management is therefore a core part of telecom security rather than an administrative afterthought.
Why a Layered Security Strategy Is More Effective
No single technology can prevent every form of voice fraud. STIR/SHAKEN strengthens caller ID authentication but it does not replace fraud analytics, network monitoring or customer protection measures.
Combine authentication with call analytics
A stronger approach combines several signals:
STIR/SHAKEN verification: Helps assess whether caller identity information is cryptographically valid.
Traffic analytics: Identifies unusual calling patterns and suspicious volumes.
Number reputation: Uses complaint data and known risk indicators to identify numbers associated with abusive activity.
Call treatment policies: Helps manage calls based on verification results and risk indicators.
Incident monitoring: Supports investigation and response when new fraud patterns emerge.
For example a call may carry a valid STIR/SHAKEN signature but still exhibit suspicious behaviour such as an unusual calling rate or a history of complaints. Authentication and analytics provide different kinds of evidence. Using both gives operators a more informed basis for deciding how to handle the call.
Protect the network and the customer
Telecom providers should also maintain strong access controls, secure private-key handling, regular certificate checks and clear incident-response procedures. Businesses can complement network-level protection with employee verification procedures such as calling back through a known number before acting on an urgent financial request.
This is similar to securing a building: an identity badge helps confirm who has access but surveillance, access policies and human judgement are still needed.
Certificate Management Is a Practical Part of Modern Voice Security
STIR/SHAKEN depends on a functioning certificate infrastructure. Providers need a reliable process to generate private keys, obtain certificates and keep certificate information available for verification.
Reduce manual complexity with automation
Manual certificate handling can create operational overhead. It may also increase the chance of missed renewals, inconsistent configurations or avoidable human error. API-driven certificate workflows can help service providers integrate certificate operations into their existing systems.
PeeringHub provides a STIR/SHAKEN Certificate Authority service with a developer-focused API workflow. Its documentation describes a process for generating a private key, receiving a unique key identifier and using that identifier to request a STIR/SHAKEN certificate. The certificate-generation API returns a certificate repository path for retrieval.
This can help providers incorporate certificate issuance into repeatable operational workflows rather than treating each certificate request as an isolated manual task. PeeringHub also documents an ACME-based certificate service designed around RFC 8555.
Keep lifecycle controls in focus
Automation does not remove the need for governance. Providers should maintain clear ownership of keys, restrict access to sensitive credentials, monitor certificate expiry and follow appropriate revocation procedures. They should also confirm that their implementation meets applicable STIR/SHAKEN requirements and their network's operational needs.
Comparing Telecom Security Solutions: PeeringHub, TransNexus and TNS
Telecom providers have several options for implementing STIR/SHAKEN and strengthening voice security. The right choice depends on whether the operator needs certificate infrastructure, call authentication and verification, analytics or a broader managed solution.
PeeringHub: Certificate infrastructure and API-led workflows
PeeringHub focuses on STIR/SHAKEN Certificate Authority services and certificate lifecycle workflows. Its documented API supports private-key generation and certificate requests while its ACME service provides an alternative path for automated certificate issuance.
This approach is relevant to providers that want to simplify certificate operations and integrate them with their own telecom systems. It should be understood as a certificate infrastructure capability rather than a claim that certificate issuance alone prevents all voice fraud.
TransNexus: Integrated authentication and call treatment
TransNexus offers a broader STIR/SHAKEN solution that includes authentication, a secure key store, certificate authority and repository services, verification and call-validation treatment. Its NexOSS platform also supports Rich Call Data and different methods of handling SHAKEN PASSporTs.
This makes it relevant to providers looking for authentication and verification capabilities combined with call-treatment policies.
TNS: Authentication combined with reputation analytics
TNS Communications offers Call Guardian solutions that combine STIR/SHAKEN information with call-event analysis and reputation data. Its published solution descriptions highlight real-time robocall detection, reputation profiles and layered analytics.
This makes it relevant to operators seeking a wider call-protection and analytics approach.
What providers should evaluate
Before selecting a solution telecom operators should consider:
Certificate management: Does the platform support key generation, certificate issuance, renewal and revocation?
Authentication and verification: Are signing and verification services included?
Analytics: Does it provide traffic analysis and number reputation data?
Integration: Does it offer API support and compatibility with existing network systems?
Call treatment: Can providers apply policies to verified and suspicious calls?
These platforms address overlapping but not identical requirements. Providers should compare their actual deployment scope rather than assume that a certificate service, an authentication platform and a full call analytics solution are interchangeable.
What Telecom Providers Should Do Next
Modern voice fraud requires a shift from relying on isolated security tools to operating a coordinated protection framework.
Review existing controls
Start by identifying what current systems can and cannot detect. Review caller ID screening, number reputation, traffic monitoring and fraud-response procedures. Determine whether STIR/SHAKEN authentication and verification are implemented where required and whether certificate operations are properly managed.
Automate without weakening governance
Use APIs and established certificate workflows to reduce repetitive tasks but maintain strict access controls and key-management practices. Automation should make security operations more consistent and auditable.
Treat authentication as one part of trust
A valid signature is an important signal but it does not establish the intent behind a call. Combine cryptographic verification with analytics, operational policies and customer awareness to address a wider range of threats.
Conclusion: Traditional Controls Need Modern Reinforcement
Traditional telecom security measures still provide value but they were not designed to handle every threat created by spoofing, automated fraud and AI-generated voices. Caller ID screening and blacklists can identify known risks while STIR/SHAKEN adds a cryptographic layer that helps verify whether a calling number is authorised for use. Neither approach can replace the need for broader fraud analytics and sound operational controls.
For telecom providers the next step is to build a layered security model supported by reliable certificate management and practical automation. PeeringHub helps service providers manage STIR/SHAKEN certificate workflows through its CA service and API-driven infrastructure.
Explore PeeringHub's STIR/SHAKEN CA services and API documentation at https://www.peeringhub.io/ to assess how certificate management can fit into your voice-network security strategy!
Post a Comment