Your phone rings, it's a number you don't know, however there's a small checkmark next to the number, or the word "Verified." Most people read that as this call is safe.
It doesn't mean that. It means something much narrower, and the difference matters, because a scam call can carry that checkmark quite legitimately.
The system behind it is called STIR/SHAKEN. Here's what it actually checks, what the A, B, and C ratings behind it mean, and why a verified call still deserves your suspicion.
What is STIR/SHAKEN?
STIR/SHAKEN is a system that lets your phone company confirm that a caller is allowed to use the number they're displaying.
It works like a wax seal on a letter. Before the call leaves, the caller's phone company attaches a digital signature to it. When the call reaches your phone company, it checks that seal. If the seal is intact and comes from a company it recognises, the number is genuine and hasn't been tampered with along the way.
The name is just two standards stuck together, one covering the cryptography, one covering how phone companies actually use it. Nobody needs to remember which is which.
There's nothing for you to install or switch on. This all happens between phone companies before your phone rings. The only part you ever see is the badge, if your carrier chooses to show one.
Why it had to be invented
Caller ID was never built to be checked. When it was designed, only phone companies could place calls into the network, and they were trusted to be honest. So the system displays whatever number it's handed.
Once anyone with an internet connection could make phone calls, that assumption fell apart. Showing a different number became a simple setting in ordinary phone software, and scam operations used it at enormous scale.
STIR/SHAKEN was the industry's answer. It doesn't fix the original design, rather it adds a layer on top that can prove one specific thing that was never provable before.
What happens when you get a signed call
- Someone places a call, and their phone company looks at who they are and what number they want to display.
- It decides how confident it is about that pairing. This is the A, B, or C rating.
- It attaches a digital signature carrying that rating, the number calling, the number being called, and a timestamp.
- The call travels across the network. Other companies pass the signature along untouched, and can't quietly upgrade the rating, because changing anything breaks the seal.
- Your phone company checks the signature and decides what to show you.
All of it happens in a fraction of a second.
What A, B, and C mean
This is the part worth understanding, because "verified" covers three quite different situations. The rating is the calling company's honest statement about how much it actually knows.
| Rating | Name | What the phone company is saying |
|---|---|---|
| A | Full | We know who this customer is, and we've confirmed this number is theirs to use |
| B | Partial | We know who this customer is, but we can't confirm the number is theirs |
| C | Gateway | We only know where this call entered our network. We know nothing about the caller |
A few things follow from that:
- B isn't an accusation. It's ordinary for a business whose phone number was issued by a different company than the one carrying its calls.
- C is common for international calls, because a company handling a call that arrived from three networks away has no relationship with whoever placed it.
- A low rating rarely blocks a call by itself. It's one ingredient in the spam-scoring systems that decide whether to label a call.
What the checkmark does not mean
Here's the sentence to remember: it vouches for the number, not for what the call says.
A verified call means the caller was entitled to display that number. That's useful as it stops the wholesale impersonation of any number a scammer fancied. But it's far narrower than most people assume.
- It says nothing about honesty. Someone running a scam from a number they legitimately own gets a full A rating and a perfect signature. The number is real. The pitch is a lie.
- It doesn't check the name. The name on your screen comes from a completely separate lookup that isn't signed or verified at all.
- It doesn't judge whether you want the call. Telemarketers sign their calls too.
Never treat a verified badge as a reason to trust a caller. If someone asks for a passcode, a payment, or access to your device, hang up and call the organisation back on a number you looked up yourself. The signature proves a phone number. It can't prove intent.
Why some calls have no signature
An unsigned call isn't automatically suspicious. There are dull reasons for it:
- Older equipment. The system only works over internet-based call routing. Calls crossing older network segments can lose the signature entirely.
- International calls. These systems are national, so calls from abroad usually arrive unsigned or with a C rating.
- Small or older providers. Coverage isn't universal.
So "no badge" tells you very little, and "badge" tells you less than it looks like. Both are weak signals compared to simply not giving anything sensitive to an unexpected caller.
Does it actually stop robocalls?
Partly. US phone companies have been required to use it since 2021, and rules have tightened steadily since, regulators now focus less on the cryptography and more on whether companies genuinely know the customers whose calls they're signing. Companies that don't comply get cut off from sending traffic at all.
It's made calls traceable after the fact, which is what enforcement actions are built on, and it's made mass number-impersonation much harder. What it can't do is tell a wanted call from an unwanted one. That job still belongs to the spam-scoring systems, which use the rating as one signal among many.
If you make business calls
The rating matters to you in a practical way: spam-labelling systems weigh it. Full A ratings help your calls get through, B is roughly neutral, and unsigned or C-rated traffic is treated with real suspicion.
Getting to A generally means the number you display has to be one your phone provider has verified you're entitled to use. If your calls are being labelled as spam, ask your provider what rating your traffic gets. It's a question they can answer, and it's one of the first things worth checking.
!faq !faq-q What does STIR/SHAKEN mean in simple terms? !faq-a It's a system where the caller's phone company digitally signs a call to confirm the caller is allowed to use the number being displayed, and the receiving phone company checks that signature before your phone rings. Think of it as a wax seal on an envelope.
!faq-q What does the checkmark or "Verified" label on a call actually mean? !faq-a Only that the number is genuine and the caller was entitled to use it. It says nothing about whether the caller is honest or whether you want to hear from them. Scammers calling from numbers they legitimately own pass the check.
!faq-q What is the difference between A, B, and C attestation? !faq-a A means the phone company verified both the customer and their right to use the number. B means it verified the customer but not the number. C means it only knows where the call entered its network, which is common for international calls. The rating is set when the call is signed and can't be changed later without breaking the signature.
!faq-q Does STIR/SHAKEN stop robocalls? !faq-a Not by itself. It makes calls traceable and stops scammers displaying any number they like, which helps a great deal. But a caller using their own real numbers still passes, so spam filtering remains a separate job.
!faq-q Why do some calls have no verification badge? !faq-a Usually for technical reasons rather than suspicious ones. The system needs internet-based call routing, so calls crossing older equipment can lose the signature, and international calls typically arrive unsigned. A missing badge on its own doesn't mean much.
!faq-q Does it verify the caller's name too? !faq-a No. Only the phone number, the number being called, and the time. The name displayed on your screen comes from a separate database lookup that isn't verified at all, which is why business names on caller ID are so often wrong or missing.
!faq-q Do I need to do anything to turn it on? !faq-a No. It operates entirely between phone companies. The only thing you might do is check with your carrier whether they display verification results, since not all of them show a badge. !faq-end
STIR/SHAKEN gave the phone network something it never had: a reliable answer to is this caller allowed to use this number? Everything built since like: spam labelling, verified business calling, the enforcement actions against large scam operations depends on that answer existing. What it will never give you is a judgement about the person on the other end of the line. That part is still yours to make.
