STIR/SHAKEN is Here – Now What?

STIR/SHAKEN Cartoon

There’s no denying that the United States is in the grip of a major epidemic of a different kind – robocalls. The TNS Robocall Investigation Report suggests that Americans received 80 billion robocalls in the US in the past year alone. However, less than five percent of the calls came from the top six US carriers. These figures show that spammers are increasingly utilizing VoIP providers. The FCC has taken steps to prevent the spread of these Robocalls. A recent measure requires all providers to use STIR/SHAKEN or set up a Robocall Mitigation program.

What is STIR/SHAKEN?

STIR/SHAKEN is a set of protocols that prevent robocallers from spoofing caller-id. It requires that VoIP providers authenticate all calls to your telephone number with a digital signature to verify their origin. Without this digital signature, the sending provider considers the call “spoofed” and will not allow it to complete.

As the name implies, STIR/SHAKEN consists of two standards. Short for Secure Telephony Identity Revisited, STIR authenticates the caller ID information of calls routed through a VoIP network. SHAKEN, or Signature-based Handling of Asserted Information Using Tokens, specifies how digitally signed information can be transported across communications networks. Together, STIR/SHAKEN provide an attestation method that validates the calling party’s phone number.

Unintended Consequences of STIR/SHAKEN

STIR/SHAKEN aims to curb robocalls by requiring businesses to use their own verified numbers. The idea is to improve the fidelity of calls for recipients’ and authorities’ ability to identify and trace them if they spam or violate any laws. However, this may also have some unintended consequences in the following scenarios:

Call-Forwarding

Consider a scenario in which you receive a call from someone outside, and the system keeps the caller-id when forwarding the call. In the case of STIR/SHAKEN, since the carrier forwarding the call does not possess the phone number, the call will appear as “spoofed”. It is unlikely that the call will complete in this case. Many businesses use call forwarding and follow-me features, and this is certainly not good news for them.

To work around this issue, you will need to have your phone system reconfigured to change the caller id. This way, a call coming into the system is forwarded as a call with a system’s caller id. The drawback is that you will see that the call comes from your office number but lose the ability to identify the caller.

Impact on Call Centers and BPOs

Call centers and business process outsourcing (BPOs) often originate calls from large blocks of phone numbers to hide their identity from the customers. Some small businesses need to call customers anonymously. STIR/SHAKEN will make it impossible for call centers to use phone number spoofing the same way they have in the past. At best, the recipient will see a message “Scam Likely”. In most cases, however, the call will simply fail to originate. STIR/SHAKEN will require call centers to have a genuine business number that they must own. This requirement will make it harder for call center agents to hide their physical location from customers. It would also mean that STIR/SHAKEN will make North America-based call centers less competitive. Another possible unintended consequence is that robocallers outside of the US and Canada will begin using international numbers making calls appear to be coming from some number outside of the US.

Of course, some call recipients may have a favorite cousin living in a far-away country or conduct business internationally. Most of us are likely to ignore an international call from an unknown number.

Porting Phone Numbers

Usually, when you port your number from one provider to another, you can still use it without affecting your Caller-ID. However, STIR/SHAKEN will not allow you to use the number until your new service provider takes possession of it. In the meantime, you’ll have to use a temporary number provided to you by the new provider. The use of a temporary number is not a problem, but it means that your customers and everybody you call will not recognize a call coming from an unknown number. It will also put a strain on carriers to reduce port times for DIDs (phone numbers).

Privacy Concerns

Many industries, such as healthcare, legal services, and financial advisors, use masked numbers for privacy. Although it isn’t mandatory for a caller to disclose the phone number, and there is an option not to provide any caller-id, how many people will answer a call from a hidden number? Before STIR/SHAKEN, doctors could call from a random number that does not receive calls back. Now they can only make outbound calls from the numbers that belong to them. It’s an unintended consequence since it results in inconvenience in some legitimate scenarios.

Conclusion

STIR/SHAKEN’s purpose is to counter the growing problem of spoofing. There isn’t much that is convenient regarding VoIP security standards. The good news is that most carriers and VoIP providers have already adopted it, and smaller players are following.

DLS Hosted PBX has become STIR/SHAKEN compliant in version 5.6 of our Hosted PBX. We remain committed to providing rich communication solutions for businesses of all sizes. If you have questions about STIR/SHAKEN or our services, please let us know in the comments below or contact our technical support or sales team.

Leave a Comment