If you run outbound IVR calls such as payment reminders, appointment confirmations or service alerts, STIR/SHAKEN affects whether people see a verified number or a spam warning. It does not block calls by itself, but carriers and call-blocking apps use its results when they decide how to label or block your calls. This guide explains how it works, what the attestation levels mean, and the practical steps that help legitimate outbound programs get answered.
What is STIR/SHAKEN?
STIR/SHAKEN is a caller ID authentication framework that lets phone companies digitally sign and verify the caller ID on calls carried over IP networks. The FCC requires voice service providers to use it so that the receiving carrier can confirm a call really comes from the number shown, which makes illegal spoofing harder.
STIR stands for Secure Telephone Identity Revisited and SHAKEN for Signature-based Handling of Asserted Information Using toKENs. In practice, the originating carrier attaches a signed certificate to the call, and the terminating carrier checks it before the call reaches your customer.
Is STIR/SHAKEN required?
Yes, for phone companies. The FCC's 2020 rules required voice service providers to implement STIR/SHAKEN in the IP portions of their networks by June 30, 2021, and the obligation has since expanded to gateway providers and to intermediate providers that receive unauthenticated calls directly from originating providers. The FCC also requires all providers to file in the Robocall Mitigation Database, and downstream providers may not accept traffic from providers that are not listed.
Businesses that place calls do not sign calls themselves. Your voice provider does. What you control is how your numbers are set up, which provider places your calls, and how your calls behave.
The rules keep developing. In a 2024 order, the FCC set conditions for providers that use third parties to sign calls, including that calls be signed with the obligated provider's own certificate and that the provider make the attestation decision.
What do attestation levels A, B and C mean?
The attestation level tells downstream carriers how much the signing provider knows about the caller and the number. The FCC summarizes the three levels, defined in industry standard ATIS-1000074, in a 2024 enforcement notice:
| Level | Name | What the signing provider confirms | What it means for your calls |
|---|---|---|---|
| A | Full attestation | It originated the call, knows the customer, and has verified the customer's right to use the calling number | The strongest signal; the best basis for a "verified" display |
| B | Partial attestation | It originated the call and knows the customer, but has not verified the customer's right to use that number | Common when you call out through one provider using a number held elsewhere |
| C | Gateway attestation | It has no relationship with the call's initiator, such as an international gateway | The weakest signal; more likely to be treated with suspicion |
The B-level case catches many legitimate businesses. As Plum's STIR/SHAKEN guide explains, if you own a number through one carrier but place outbound calls through another, the outbound carrier cannot fully attest to the caller ID, even though you have the right to use that number.
What is ANI, and why does your calling number matter?
ANI (Automatic Number Identification) is the calling number your provider sends with each call, and it is the number that STIR/SHAKEN signs and caller ID displays. In the U.S., phone numbers follow the North American Numbering Plan: a three-digit area code, a three-digit prefix and a four-digit line number.
The number you send matters for three reasons:
- Attestation. A number your outbound provider can verify supports A-level attestation. A number held by another carrier often gets B.
- Recognition. Customers are more likely to answer a number they recognize or have saved.
- Reputation. Call-labeling services track how each number behaves over time.
What do call labeling and blocking mean for outbound notifications?
Call labeling and blocking are separate from STIR/SHAKEN. Carriers and analytics companies score incoming numbers and may show a warning such as "Spam Likely," send the call to voicemail, or block it. The FCC allowed carriers to offer call blocking by default on an opt-out basis in 2019.
That creates risk for legitimate outbound programs. Plum's guide notes that analytics often look for patterns such as high volumes of short calls, and that school closings, weather alerts and patient reminders can be misjudged as spam. It also notes that low answer rates and calls under 60 seconds can hurt how your calls are treated.
Two FCC protections help legitimate callers:
- In a February 2025 order, the FCC made SIP code 603+ the required code that terminating providers must return when they block a call based on analytics, so callers learn when and why calls are blocked and can seek a fix.
- On Android phones, a verified call can show "Caller Verified," and on iPhones verified calls show a check mark in Recents, according to Plum's guide. Display varies by carrier and device.
How can you improve answer rates for outbound IVR calls?
Use numbers your outbound provider can fully attest, register them with the analytics companies carriers use, and run calls that customers expect and engage with. Follow these steps:
- Call from a number your outbound provider controls. This gives the provider the best chance to apply A-level attestation.
- Register your numbers for allowlisting. Submit your legitimate use cases to the analytics partners behind major carriers. Plum's guide links to the request forms for Hiya (AT&T), TNS (Verizon) and First Orion (T-Mobile).
- Ask customers to save your number. Include it in welcome emails, statements and your website so customers add it to their contacts.
- Use consistent numbers. Frequently changing numbers makes it harder for customers to recognize you and for each number to build a good history. Keep a stable, published set of outbound numbers per program.
- Call people who expect it. Get consent, keep lists current, and remove numbers that never answer. This also supports your obligations under consumer protection rules.
- Make calls worth staying on. Identify your business in the first seconds, state the reason, and offer a clear action, such as pressing 1 to pay or confirm. Engaged calls last longer and look less like robocalls.
- Pair voice with text where it fits. A text that warns a call is coming, or replaces it, can lift response. Texting from local numbers requires 10DLC registration.
- Watch for blocking signals. Track answer rates and call durations by number, and investigate sudden drops quickly.
How Plum Voice handles this
Plum's documentation on robocalling, STIR/SHAKEN and ANI recommends using a Plum Voice ANI for outbound calls to maximize the chance of full (A-level) attestation. Customers can contact Plum support to set this up. The same page includes a best practices checklist and the allowlisting links above.
Outbound programs such as payment reminders and appointment confirmations can be built in Plum Fuse or coded in Plum DEV. See outbound messaging and notifications for common use cases, and our guide to IVR payments and PCI compliance if your reminders collect payments.