A phone displays your company's number when you make an outbound call. But how does the person receiving that call know the number genuinely belongs to your business? Traditional Caller ID can display a familiar number without independently proving that the caller is authorised to use it.
This is where STIR/SHAKEN makes a difference. It introduces a cryptographic authentication process that helps participating voice service providers verify caller ID information across compatible IP networks. For enterprises and telecom operators, understanding the distinction is essential to building more trustworthy voice communication infrastructure.
Understanding Traditional Caller ID and STIR/SHAKEN
What Is Traditional Caller ID?
Traditional Caller ID is a telecommunications feature that presents information about an incoming call to the recipient. Depending on the network and available services, this information may include the calling telephone number and a caller name.
The number is transmitted through the telephone network and displayed on the recipient's device. Caller name information may be obtained through Caller Name (CNAM) databases, which associate telephone numbers with subscriber names.
For example, when a customer receives a call from a bank, their phone may display the bank's telephone number or a name associated with that number.
However, traditional Caller ID does not independently establish whether the caller is authorised to use the displayed number. A fraudster may manipulate caller ID information to make a call appear to originate from a trusted organisation.
What Is STIR/SHAKEN?
STIR/SHAKEN is a framework designed to authenticate and verify caller ID information using digital certificates and cryptographic signatures.
It combines two technical standards:
STIR (Secure Telephone Identity Revisited): Defines the methods used to digitally sign and verify caller identity information.
SHAKEN (Signature-based Handling of Asserted Information Using toKENs): Defines how these standards are implemented across participating telephone networks.
When an eligible call is originated through an IP-based network, the originating provider creates a digitally signed authentication token and includes it in the SIP Identity header. The receiving provider can then use the associated certificate to verify the signature and the information carried with the call.
The key difference is straightforward: traditional Caller ID displays calling information while STIR/SHAKEN adds a mechanism to authenticate that information.
The FCC identifies STIR/SHAKEN as a framework for making caller ID spoofing more difficult by allowing originating providers to authenticate calling information and terminating providers to verify it.
2. STIR/SHAKEN vs. Traditional Caller ID: The Key Differences
Displaying Information vs. Verifying Information
Both technologies relate to caller identity but perform different functions.
Traditional Caller ID primarily presents the telephone number associated with an incoming call. STIR/SHAKEN adds a verification mechanism that helps participating networks determine whether the calling-number information has been authenticated.
Think of traditional Caller ID as the name printed on a delivery package. It tells the recipient who the sender claims to be. STIR/SHAKEN adds a digital security seal that allows the delivery system to check whether the sender's information has been authenticated.
How Do They Differ in Practice?
The main differences can be understood through their individual capabilities:
Primary function: Traditional Caller ID displays the calling number and potentially the caller name. STIR/SHAKEN authenticates caller ID information.
Verification: Traditional Caller ID does not independently verify number authorisation. STIR/SHAKEN uses digital signatures and certificates to support verification.
Spoofing protection: Traditional Caller ID can display manipulated information. STIR/SHAKEN helps participating providers identify unauthorised or altered caller ID information.
Technical foundation: Traditional Caller ID relies on telephone network signalling and caller name services. STIR/SHAKEN operates through SIP-based IP networks.
Provider involvement: Traditional Caller ID transmits calling information. STIR/SHAKEN involves authentication by the originating provider and verification by the receiving provider.
Attestation: Traditional Caller ID does not include STIR/SHAKEN attestation. The framework uses A, B and C attestation levels to communicate the originating provider's level of confidence.
Limitations: Traditional Caller ID cannot independently establish whether a displayed number is authentic. STIR/SHAKEN does not prove caller intent or guarantee that a call is safe.
The technologies are not replacements for one another. STIR/SHAKEN strengthens the trustworthiness of caller ID information while traditional Caller ID remains part of how calling information is presented to recipients.
Why the Difference Matters
Consider a fraudster who imitates a company's customer support number. With traditional Caller ID, the recipient may see the company's genuine number even though the call is unrelated to that business.
With STIR/SHAKEN, participating providers have a way to authenticate and verify the calling-number information. This makes certain forms of spoofing more difficult and gives receiving networks better information for call-handling decisions.
How STIR/SHAKEN Authentication Works Behind a Business Call
Step 1: The Originating Provider Authenticates the Call
When a customer or business places a call through an eligible voice provider, the provider evaluates the caller's identity and relationship with the telephone number.
The provider then assigns an appropriate attestation level and digitally signs the relevant caller identity information using its authorised certificate.
Step 2: The Authentication Information Travels With the Call
The signed information is carried in the SIP Identity header. It includes the originating telephone number, the provider's digital signature and the attestation information.
Intermediate providers are expected to preserve and pass along authenticated caller ID information in accordance with the applicable technical and regulatory requirements.
Step 3: The Receiving Provider Verifies the Information
The terminating provider retrieves the relevant public certificate and checks the digital signature.
If verification succeeds, the provider has evidence that the signed caller identity information is valid and has not been altered in a way that invalidates the signature.
The receiving provider can use this information as part of its call-handling process.
An Enterprise Example
Imagine an insurance company contacting a customer about a policy renewal. Its originating voice provider authenticates the call using the appropriate certificate and includes the signed information in the SIP signalling.
When the call reaches a participating receiving provider, that provider can verify the signature and evaluate the authentication result.
This creates a stronger technical basis for trusting the presented calling number than simply relying on the number displayed on the recipient's screen.
However, successful authentication does not prove that the person speaking is an authorised employee or that the conversation is legitimate. It establishes confidence in the authenticated calling information.
Understanding A, B and C Attestation Levels
What Do the Three Levels Represent?
STIR/SHAKEN uses three attestation levels to communicate how much confidence the originating provider has in the caller's relationship with the telephone number.
A – Full Attestation: The provider originates the call, has a direct authenticated relationship with the customer and has verified the customer's authority to use the calling number.
B – Partial Attestation: The provider knows the customer and originates the call but cannot verify the customer's authority to use the specific telephone number.
C – Gateway Attestation: The provider identifies the network point where the call entered its infrastructure but does not have the required direct relationship with the original caller.
Why Attestation Matters
Imagine a business using a telephone number assigned directly by its voice service provider. If the provider has verified the business and its authority to use that number, the call may qualify for full attestation.
In another situation, a provider may know its customer but lack sufficient evidence to verify the customer's authority to use the presented number. That may result in partial attestation.
These levels provide useful context to downstream providers. They should not be interpreted as universal ratings of caller safety.
A C-level call is not automatically fraudulent and an A-level call is not automatically safe. Attestation describes the originating provider's knowledge and verification of the caller's relationship with the number.
It is also important to understand that the originating voice service provider makes the attestation decision. A Certificate Authority supplies the certificate infrastructure used for signing but does not independently assign attestation.
What Traditional Caller ID and STIR/SHAKEN Cannot Do
Authentication Is Not the Same as Caller Identification
One common misunderstanding is that STIR/SHAKEN automatically displays a company's name or logo on the recipient's phone.
It does not.
STIR/SHAKEN authenticates caller ID information at the network level. Traditional caller name services and branded calling technologies perform different functions by providing additional information for display on supported devices and networks.
The FCC has highlighted this distinction in its 2025 caller identity proceedings. It noted that authentication can help indicate whether a number is spoofed but does not necessarily tell consumers who is calling.
Authentication Does Not Guarantee a Safe Call
A successfully authenticated call may still contain misleading information, unwanted sales communication or fraudulent requests.
For example, a fraudster who gains access to an authorised calling account or abuses a legitimate customer relationship may still create risks that caller ID authentication alone cannot resolve.
Businesses should therefore combine caller authentication with appropriate customer verification, account security, fraud monitoring and responsible communication practices.
Network Compatibility Also Matters
STIR/SHAKEN relies on SIP signalling and operates in IP-based portions of voice networks. Calls that pass through traditional non-IP infrastructure such as TDM networks may lose their authentication information.
This means that not every call will arrive with verifiable STIR/SHAKEN data, even if authentication was performed at the originating end.
The FCC has recognised this limitation and has examined approaches to caller ID authentication in non-IP networks. <Cite refs={["turn593949view0","turn710666search32"]}/>
How PeeringHub Supports STIR/SHAKEN Certificate Infrastructure
Why Certificate Management Is Important
STIR/SHAKEN relies on a trusted certificate governance system. Eligible voice service providers need authorised certificates to sign caller identity information and support the authentication process.
These certificates must be issued, hosted and maintained through appropriate infrastructure. Manual certificate operations can become difficult to manage as networks grow and renewal requirements become more frequent.
PeeringHub focuses on this technical foundation through its STIR/SHAKEN Certificate Authority services and supporting tools.
PeeringHub's Certificate and Developer Capabilities
Its documented services include:
STI-ACME Server: An RFC 8555-compliant ACME service that supports automated STIR/SHAKEN certificate issuance.
Certificate Repository (STI-CR): Hosts certificates and makes them available through the appropriate certificate URLs. ACME handles certificate lifecycle operations while the repository provides certificate hosting.
STI API: Supports authentication token generation, private key generation and certificate requests.
Identity Header Parser: Helps developers decode and inspect SIP Identity header information.
Certificate Inspector: Supports technical examination and validation of STIR/SHAKEN certificates.
Python Tools: Provides additional options for certificate-related development and lifecycle management.
Eligible providers must have their own OCN and approved STIR/SHAKEN Service Provider status from the STI Policy Administrator before using PeeringHub's ACME certificate issuance service.
Choosing Infrastructure Based on the Required Function
Telecom solutions can serve different purposes. Some platforms focus on certificate issuance and management while others concentrate on call analytics, branded calling, reputation scoring or call blocking.
These capabilities should be evaluated separately rather than treated as interchangeable.
PeeringHub's documented focus is certificate infrastructure and developer tooling for STIR/SHAKEN workflows. It supports providers with certificate issuance, hosting, lifecycle management and technical inspection rather than independently handling every stage of call authentication or fraud prevention.
Explore PeeringHub's documentation to understand its certificate services and integration options.
Conclusion: Why STIR/SHAKEN Is the Next Step Beyond Traditional Caller ID
Traditional Caller ID helps people see which telephone number is calling. However, it does not independently prove that the caller is authorised to use that number. STIR/SHAKEN strengthens this process by introducing cryptographic authentication and verification across compatible IP-based voice networks.
For enterprises, the distinction is important. A displayed number provides identification information while authentication gives participating providers a stronger technical basis for evaluating its validity.
Neither technology guarantees that every call is legitimate or that every recipient will answer. But together with responsible communication practices and wider security controls, they contribute to a more trustworthy voice ecosystem.
Reliable certificate infrastructure is central to making STIR/SHAKEN workflows possible. PeeringHub supports this requirement through its STI-ACME service, Certificate Repository, STI API and developer tools.
Ready to strengthen the technical foundation of your caller authentication workflows?
Visit https://www.peeringhub.io/ to explore PeeringHub's STIR/SHAKEN certificate solutions and build more reliable authentication infrastructure.
Regulatory note: STIR/SHAKEN requirements discussed in this article primarily relate to the United States telecommunications framework. Applicability depends on provider role, network configuration and relevant exemptions. This article is an educational overview and not legal advice.
Post a Comment