# STIR/SHAKEN vs. caller identity verification for businesses

> STIR/SHAKEN checks whether a provider vouches for a calling number, not who is speaking. What it covers, where it ends and when companies need more.

Source: https://identityphone.com/en/blog/stir-shaken-vs-caller-identity-verification/
Language: en · Published: 2026-11-07 · Updated: 2026-11-07 · Publisher: Identity Phone

STIR/SHAKEN lets the originating provider sign how well it knows the caller's right to use a number. It does not identify the person speaking, is not shown to most recipients and does not cover every route. Caller identity verification checks the person or enrolled account behind a call – companies need both for sensitive requests.

A phone system that supports STIR/SHAKEN can tell whether the provider that started a call is willing to vouch for the calling number. That is useful – and regularly misunderstood. **STIR/SHAKEN authenticates the number's origin, not the person on the line.** For a help desk resetting MFA or a finance team approving a payment, that difference decides whether a check actually protects anything.

This guide explains what network call authentication proves, where it stops, how the situation differs between the US and Europe, and which additional layer companies need for sensitive calls.

## What STIR/SHAKEN actually checks

STIR is a set of IETF standards for signing call information ([RFC 8224](https://www.rfc-editor.org/rfc/rfc8224.html)); SHAKEN describes how carriers deploy it. Simplified, a signed call works like this:

1. The originating provider attaches a digitally signed token to the call. It contains the calling number, the called number, a timestamp and an **attestation level**.
2. The terminating provider checks the signature against the originating provider's certificate.
3. The terminating provider uses the result – for example to label, route or block calls – according to its own policy and local rules.

The attestation level ([RFC 8588](https://www.rfc-editor.org/rfc/rfc8588.html)) is the originating provider's statement about how well it knows the caller's right to use the number: **A** (customer known and authorized for this number), **B** (customer known, authorization for this number not established) or **C** (the provider only knows where the call entered its network). Our [guide to caller ID spoofing](/en/blog/caller-id-spoofing-explained/) explains the three levels in more detail.

## What it does not prove

**The person speaking.** Attestation is about a number and a customer account. An employee's colleague, an attacker on a compromised softphone account or someone using their own legitimately obtained number can all place calls with A-level attestation.

**That the request is legitimate.** A correctly signed call can still be a social engineering attempt. The checks that matter for a password reset or a bank-detail change happen after the call is connected.

**Anything on routes that are not signed end to end.** STIR/SHAKEN depends on IP-based call signalling. Calls that cross older non-IP network segments can lose the signature; the FCC has [proposed requiring providers to close this gap](https://docs.fcc.gov/public/attachments/DOC-411101A1.txt). International calls often enter a network through a gateway and can at best receive C-level attestation.

**Anything the recipient can see.** In most phone systems the attestation is evaluated by the network, not displayed to the employee answering the call. Some devices show a "verified" indicator; many desk phones, softphones and contact-centre platforms show nothing.

**That a B- or C-level call is fraudulent.** Companies that send calls through a third-party platform, a call centre or a cloud PBX while displaying their main number may receive B-level attestation unless the provider has established their right to that number. B is therefore not automatically suspicious.

Even regulators that rely on the mechanism say this clearly. France's telecom regulator Arcep writes that the number authentication obligation [does not on its own prevent number spoofing](https://www.arcep.fr/mes-demarches-et-services/consommateurs/fiches-pratiques/usurpation-de-numero-de-telephone-fixe-ou-mobile-que-dois-je-faire.html); its main benefit is that the signing operator can be identified.

## The US and Europe are in different places

| Region | Main measure | What companies should know |
|---|---|---|
| United States, Canada | STIR/SHAKEN for IP-based voice traffic, with ongoing rule-making on non-IP segments and caller identity information | Widest deployment, but the result is a network signal, not a person check |
| France | Number authentication (MAN), based on STIR/SHAKEN. According to Arcep, unauthenticated calls with French fixed numbers are cut from October 2024, mobile from January 2025; since 1 January 2026, unauthenticated French mobile numbers on calls from abroad are shown as hidden | Calls displaying a French number are checked more strictly – attackers shift to other numbers and channels |
| Germany | [Section 120 of the Telecommunications Act](https://www.gesetze-im-internet.de/tkg_2021/__120.html): German caller IDs on calls handed over from foreign networks must generally be suppressed (with an exception related to mobile roaming); certain numbers such as 110 and 112 must be blocked | No STIR/SHAKEN-style signature for the recipient; a displayed German number is still no proof of the person |
| United Kingdom | Ofcom-backed blocking of calls from abroad that present UK landline numbers (since early 2025); further measures for UK mobile numbers have been under consultation | Similar idea to Germany: filter implausible numbers at the border |
| Other EU countries | National measures vary; there is no EU-wide authentication requirement | Ask your provider what is actually verified on your routes |

Rules change; check the national regulator before relying on a specific date or exception. None of these measures verifies the individual caller.

## Four layers that are often confused

| Layer | What it confirms | Typical owner | Limit |
|---|---|---|---|
| **Network attestation** (STIR/SHAKEN, MAN) | A provider vouches for the calling number to a stated degree | Telephony providers | Number, not person; route-dependent; usually invisible |
| **Branded calling / Rich Call Data** | A vetted company name or logo for registered outbound numbers | Company + branded-calling provider | Shows the company, not the employee; mainly for outbound calls to customers |
| **Number reputation and spam labels** | How a number has behaved in the past | Carriers, apps, lookup APIs | A clean new or spoofed number can look harmless |
| **Caller identity verification** | The enrolled person, account or device behind this specific call, or an independent confirmation through a trusted channel | Company (IT, security, finance) | Needs secure enrollment and recovery; covers known parties, not every unknown caller |

The first three layers answer "is this number plausible?". Only the fourth answers the question a help desk agent or finance clerk actually has: **"is this really the person who may ask for this?"**

## What caller identity verification looks like in practice

Caller identity verification does not have to mean new technology. The most robust forms today are procedural:

- **Callback on a number on file.** End the call and call back through the directory or HR system, never on a number the caller provides.
- **Approval through an existing factor.** Ask the user to confirm the request in an authenticator app or on a registered device they already control.
- **Second-person confirmation** for executive, administrator and finance requests, reached through the directory.

Technical approaches add a cryptographic link between a call and an enrolled identity: employees or customers register once, and later calls between enrolled parties can be checked against that enrollment. This works for known relationships – colleague to help desk, executive to finance – and is only as strong as its enrollment and account recovery. If an attacker can re-enroll a "lost" device with a phone call, the cryptography protects nothing.

Audio analysis for synthetic voices is a separate signal again. It can point to a possible deepfake but can miss fakes and raise false alarms; see [how to detect deepfake voice calls](/en/blog/how-to-detect-deepfake-voice-calls/).

## Which calls need which layer

- **Unknown inbound calls to employees:** network filtering and reputation reduce volume. Any request for money, data, codes or access goes through the independent callback rule.
- **IT help desk:** never reset passwords or MFA on the basis of caller ID or a voice. Use a callback, an existing factor or a second approver – our guide to [help desk caller verification](/en/solutions/help-desk-verification/) has a complete process.
- **Payment and bank-detail requests:** confirm through a channel already on file, with two people for new beneficiaries. See [verifying payment requests by phone](/en/solutions/payment-request-verification/).
- **Your outbound calls to customers:** ask your provider for A-level attestation on your numbers and consider branded calling, so customers can tell your real calls from impostors – and publish how you will never contact them.

## Questions to ask your telephony provider

1. Do you sign our outbound calls, and with which attestation level for each number range and platform we use?
2. Do you verify inbound signatures, and what do you do with unsigned, invalid or C-level calls?
3. Is any verification result passed to our PBX, contact centre or softphones – and can we log it?
4. Which national rules (for example §120 TKG in Germany or MAN in France) apply to our routes, and how are calls from abroad treated?
5. How do you handle reports that our numbers are being spoofed?

Write down the answers. They tell you what your network signals mean – and where your own verification process has to take over.

## What Identity Phone is building

[Identity Phone](/en/) is in development for business customers. Planned capabilities include verified caller identity between enrolled colleagues, help-desk verification before credential resets and additional risk signals for calls. These features are not yet available and have no independently verified performance results. Companies can [join the waitlist for early access](/en/waitlist/).

For a practical starting point you can use today, work through our [caller ID spoofing prevention checklist for companies](/en/solutions/caller-id-spoofing-prevention-checklist/).

## Sources and context

Written and reviewed by Johannes Wiedemann, founder of Identity Phone; published on 7 November 2026. Technical definitions follow RFC 8224 and RFC 8588; national examples are labelled and linked to regulators or legal texts. This article is not legal advice. Rules and available network signals vary by country, provider and route.

## FAQ

### Does STIR/SHAKEN stop caller ID spoofing?

It makes spoofing harder on networks and routes where calls are signed and verified, and it makes the signing provider traceable. It does not stop every spoofed call: unsigned routes, gateway traffic and legitimately signed calls from attackers' own numbers remain.

### If a call has A-level attestation, is the caller who they claim to be?

No. A-level attestation means the signing provider knows its customer and believes that customer may use the number. It says nothing about the person speaking or whether the request is legitimate.

### Is STIR/SHAKEN used in Europe?

There is no EU-wide obligation. France requires number authentication based on STIR/SHAKEN through its MAN mechanism. Other countries use different measures, such as Germany's rules for suppressing German caller IDs on calls handed over from abroad.

### What is the difference between branded calling and caller identity verification?

Branded calling shows a vetted company name or logo for outbound calls from registered numbers. It tells the recipient which company is calling, not which person is speaking. Caller identity verification checks the individual or enrolled account behind a specific call.