The STIR/SHAKEN Illusion: Why "A-Level" Attestation Still Gets Your Enterprise Calls Flagged as Spam

---

The STIR/SHAKEN Illusion: Why "A-Level" Attestation Still Gets Your Enterprise Calls Flagged as Spam

The most expensive misconception in enterprise telecommunications is the belief that STIR/SHAKEN cryptographic attestation protects your outbound calls from being labeled "Spam Likely" or outright blocked. Enterprise engineering teams spend months auditing SIP trunks, configuring certificate authority tokens, and negotiating with Tier-1 carriers to achieve coveted "Full" (A-Level) attestation—only to watch their legitimate appointment reminders, two-factor authentication callbacks, and customer success calls get flagged as predatory fraud on mobile devices. The harsh operational reality is that STIR/SHAKEN does not measure caller reputation; it merely validates number ownership. The terminating mobile carriers (AT&T, Verizon, T-Mobile) delegate call reputation entirely to third-party machine learning analytics engines that routinely penalize legitimate enterprise traffic patterns, rendering your cryptographic certificates irrelevant to call delivery.

Understanding the difference between cryptographic authentication and algorithmic reputation is the single most critical challenge in modern voice infrastructure. Until telecom leaders align their traffic engineering with the heuristics of mobile analytics engines, their outbound voice answer rates will continue to decline.

The Cryptographic Trap: Identity Does Not Equal Integrity

STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) was mandated by the FCC via the TRACED Act to eradicate caller ID spoofing. Under the protocol, when your VoIP media server places an outbound call, the originating service provider signs a SIP Identity header containing a JSON Web Token (a PASSporT, defined in RFC 8225).

The protocol assigns one of three attestation levels:

• Full Attestation (A-Level): The carrier knows the customer, verifies the customer has the direct right to use the specific calling telephone number, and signs the call with an authorized digital certificate.
• Partial Attestation (B-Level): The carrier knows the customer placing the call, but cannot verify their direct contractual ownership of the specific caller ID.
• Gateway Attestation (C-Level): The carrier originates the call from an unverified trunk or international gateway with zero visibility into number ownership.

Telecom architects mistakenly assume that A-Level attestation operates like a digital VIP pass through mobile carrier firewalls. In practice, STIR/SHAKEN answers exactly one question: "Did the entity placing this call actually own this phone number?"

"A scam call center placing thousands of abusive robocalls from a legitimately purchased block of numbers receives A-Level attestation every single time. Because robocallers operate with A-Level certificates, terminating carriers cannot treat STIR/SHAKEN as a trust signal. It is merely a prerequisite for entry, not an exemption from scrutiny."

Inside the Black Box: How Mobile Carrier Analytics Actually Score Your Calls

When an outbound call reaches a terminating wireless carrier, STIR/SHAKEN verification happens at the SIP boundary. Once verified, the call is immediately handed off to the carrier's embedded analytics partner:

• AT&T uses Hiya
• T-Mobile uses First Orion (Scam Shield)
• Verizon uses Transaction Network Services (TNS)

These analytics vendors operate proprietary machine learning models trained on millions of daily call metadata streams, subscriber report logs, and behavioral heuristics. They do not inspect your audio stream; they inspect your traffic footprint.

The Five Heuristic Traps That Trigger "Spam Likely" Flags:

1. Call Velocity and Concurrency Spikes: If your outbound SIP dialer places 300 calls in a 60-second window across a single caller ID (DID) to notify users of a scheduled maintenance window or payment confirmation, carrier algorithms classify that sudden burst as a robocall campaign. High-volume bursts instantly flag the number.
2. Short Average Duration of Call (ACD): Legitimate automated notifications—such as delivery updates or appointment confirmations—often end within 10 to 18 seconds. Mobile analytics models equate low Average Call Duration (under 20 seconds) with unanswered robocall spam, lowering the reputation score of the originating DID.
3. Low Answer Seizure Ratio (ASR): If your outbound calls have an answer rate below 15%—a common baseline when consumers avoid unfamiliar numbers—analytics models interpret the low engagement as an indicator that subscribers consider your calls unwanted.
4. "Number Recycling" Poison: When you purchase a new block of DIDs from your SIP trunk provider (Twilio, Bandwidth, Sinch), you are almost certainly buying recycled numbers. If the previous owner was a high-volume debt collection agency or aggressive telemarketer that burned the number's reputation on Hiya or TNS, that negative score remains attached to the DID in carrier databases indefinitely.
5. Inbound Call Symmetry Failure: Legitimate business numbers receive inbound return calls. If an enterprise uses an outbound-only DID that plays a generic disconnect tone or disconnects when dialed back by a mobile user, carrier analytics engines detect the zero-inbound symmetry and immediately categorize the number as an automated dialer.

The Modern Enterprise Telephony Remediation Playbook

Eliminating "Spam Likely" labels requires abandoning the assumption that carriers trust you and actively engineering your caller reputation:

• Register Directly with the Free Caller Registry (FCR): Never rely on your SIP carrier to register your numbers with mobile analytics vendors. The Free Caller Registry (freecallerregistry.com) is the centralized portal supporting direct registration with the big three analytics providers: First Orion, Hiya, and TNS. Register your organizational profile, corporate EIN, authorized business classification, and all outbound DID ranges. While registration does not grant immunity from spam flags, it establishes a verified institutional baseline that prevents automatic heuristic blacklisting.
• Implement Traffic Pacing and Distributed DID Rotation: Stop blasting outbound notification campaigns through a single number or cycling randomly through hundreds of unvetted DIDs (which analytics engines flag as "snowshoeing"). Implement strict traffic pacing at your SIP proxy layer (Kamailio, FreeSWITCH):
  • Cap outbound call volume to no more than 50–75 calls per hour per DID.
  • Group DIDs into logical, purpose-specific pools (e.g., Support, Account Security, Logistics).
  • Monitor outbound cadence to ensure volume curves mimic human enterprise communication rather than automated autodialers.
• Enforce Two-Way Call Routing and Branded Voicemail Callbacks: Every single outbound number in your enterprise fleet must be reachable via inbound routing. If a customer sees a missed call and dials back, the call must route to an intelligent IVR, customer support queue, or professional branded greeting identifying the business. Providing a functioning return path signals to carrier analytics engines that your numbers represent an authentic, accountable business operation.
• Adopt Branded Calling with Rich Call Data (STIR RCD): The next evolution of STIR/SHAKEN is Rich Call Data (RCD, per RFC 8588) and branded calling networks. Branded calling protocols cryptographically inject your verified corporate name, verified logo, and the explicit reason for the call directly onto the native mobile device call screen via push notification or carrier signaling. Mobile devices presenting verified branded calling achieve 3x higher answer rates and significantly lower user-generated spam reports.
• Establish Continuous Reputation Monitoring: A clean number today can be labeled "Spam Likely" tomorrow after a single burst notification campaign. Elite telecom teams deploy automated reputation monitoring probes: periodically dial test phones across AT&T, Verizon, and T-Mobile networks to capture real-time device screen displays and carrier metadata tags. The moment a number exhibits reputation degradation, immediately quarantine the DID, investigate the traffic pattern that triggered the penalty, and submit an automated remediation appeal through carrier analytics portals.

The Strategic Verdict

STIR/SHAKEN A-Level attestation is table stakes, not a reputation shield. Having a valid cryptographic passport gets your packets through the carrier gateway, but it will not stop mobile security algorithms from protecting their subscribers from unwanted traffic.

Stop blaming your SIP trunk provider for call delivery failures. Take ownership of your caller identity, register your numbers with the analytics gatekeepers, pace your dialer traffic, enforce two-way routing, and protect your enterprise voice brand from algorithmic destruction.