Attestation Isn’t the Whole Story: Why STIR/SHAKEN Ratings Don’t Guarantee Answered Calls

STIR/SHAKEN was a major step forward. It lets carriers confirm where a call came from by attaching what is effectively a digital signature to the caller ID. But that signature tells the network who vouched for the number. It says nothing about what the caller intends to do, or whether the person receiving the call wants it.

That distinction explains a frustrating reality for many legitimate businesses: calls that are perfectly authenticated still end up blocked or labelled as spam.

Attestation ratings matter, but they aren’t all-powerful

A call can pass authentication and still be unwanted, suspicious, spoofed or simply misjudged. Ratings of A, B or C only show that certain technical requirements were met. In fact, an "A"-rated caller can still send spam, for example by running automated campaigns from a CRM or call database. That’s why carriers and call centers alike rely on behavioural analytics that look at dialing patterns, volumes and complaint rates.

What a call attestation rating is

Under STIR/SHAKEN, the attestation rating is a trust level that helps separate verified calls from unverified ones. As industry explainers such as TransUnion’s describe it, there are three levels:

• A, full attestation: the provider has an authenticated relationship with the customer, assigned them the number and originated the call on its own network.
• B, partial attestation: the call originates on the provider’s network from a known customer, but the provider didn’t assign the number being used.
• C, gateway attestation: the call entered the network from outside and there’s no authenticated relationship with the caller. This is the lowest level of trust and can hurt a business’s calls.

What attestation was designed to do

Attestation helps authenticate the caller ID being presented, confirm who is calling and whether they control the number, and make spoofing harder. It was never intended to be a complete fraud-detection or reputation system, which is why bad actors can still find ways to make their calls look legitimate.

Why authentication doesn’t stop every scam

TNS’s 2026 half-year robocall research, as reported in the press, illustrates the gaps:

• About 85% of inter-carrier traffic between the largest US providers is signed, but smaller providers sign only around 20%.
• Roughly 17% of confirmed spoofed calls carried an A rating.
• About 1.6% of invalid numbers still received an A rating.

In other words, a call can be authenticated without being legitimate. Newer threats, including AI voice cloning, SIM box fraud and attacks that combine several channels, make scams more convincing and easier to scale.

Authentication can’t tell whether a call is wanted

A legitimate company can authenticate every call flawlessly and still irritate people by calling too often, using poor practices or generating complaints. Meanwhile, fraudsters can exploit weaknesses elsewhere in the ecosystem while presenting calls that look trustworthy. Smaller companies can be particularly exposed through legacy systems, malware or old numbers that scammers manage to acquire.

AI makes the problem harder

Security researchers, including Malwarebytes, note that AI is making robocalls more convincing, scalable and difficult to detect. A cloned voice can be produced from a short audio sample, and scammers pair cloned voices with spoofing and stolen personal details. They don’t need to break STIR/SHAKEN at all; they can route through older systems or international paths where speed takes priority over cryptographic checks.

The unintended reputation problem

Authentication was meant to raise consumer trust. But when spam and fraud keep arriving from "authenticated" numbers, that trust erodes, and legitimate businesses calling from unfamiliar numbers pay the price. As spam rises, analytics engines become more aggressive and catch more legitimate numbers. Flagging tends to spike around events that change the robocall landscape, such as new regulatory proposals or periods when enforcement is reduced.

Attestation and reputation measure different things

Attestation confirms identity. Reputation tells networks whether that identity can be trusted based on behaviour. Businesses need both. Each carrier and analytics engine applies its own technology and algorithms, and the combination of signals decides whether the terminating provider labels or blocks your number. Consumer feedback is a big part of it: spam reports from the public, including mistaken reports about legitimate calls, account for a large share of flags. That’s why managing your calls has to go beyond STIR/SHAKEN.

How a poor reputation hurts legitimate businesses

• Lower answer rates on unknown or flagged numbers.
• More voicemail, which delays outreach.
• Lost revenue from fewer conversations and conversions.
• A weaker customer experience when scheduling and updates are missed.
• Higher costs as agents spend more time reaching fewer people.

A six-layer model for trusted business calling

Since an "A" alone can’t guarantee success, combine authentication with reputation management:

1. Authentication: work with reliable, STIR/SHAKEN-compliant providers and aim for A attestation.
2. Reputation: follow dialing rules and ethical sales practices to avoid complaints, flags and blocks.
3. Analytics: watch call frequency, cadence and anomalies before they trigger labels.
4. Caller identity and branding: check that your display is consistent across networks and devices, since mismatched logos or names confuse people.
5. Continuous monitoring: track number scores for changes in flagging behaviour.
6. Remediation: correct mistaken or negative flags quickly.

Treat this as an ongoing cycle: keep call lists clean and review reports on a regular schedule.

Look beyond your attestation rating

Attestation is one piece of a trusted caller ID. Spam Checker helps you test attestation, monitor reputation and catch problems early, before legitimate calls are blocked or labelled.

Why smaller callers are especially exposed

Large enterprises often have dedicated telecom teams, modern infrastructure and long-standing provider relationships. Smaller businesses may rely on older phone systems, budget providers or numbers that were previously used by someone else. Each of those creates openings: legacy systems can be compromised, low-cost routes may not be signed properly, and recycled numbers can carry a bad history. None of these problems shows up in an attestation rating, but all of them affect whether calls are answered.

How consumer behaviour shapes your reputation

Consumers have become the front line of call filtering. When people mark calls as spam in their phone app or a call-blocking service, those reports feed directly into analytics engines. Many of those reports are mistaken, made simply because a number was unfamiliar, yet they still count against you. That’s why being recognisable matters: consistent numbers, branded displays and clear introductions reduce the chance that a genuine customer reports your call by mistake.

Putting the six layers into a weekly routine

• Monday: review last week’s flags and confirm any remediation is complete.
• Midweek: spot-check attestation on new or recently moved numbers.
• Daily: watch volume, cadence and answer rates for anomalies.
• Monthly: audit how your calls display on real devices across major networks.

Small, regular checks are far more effective than occasional deep dives after answer rates have already collapsed.

Clean lists and regular reports

Attestation and reputation management only work as a continuous cycle. Keep your call lists clean so you aren’t generating complaints from people who never wanted to hear from you, and review reputation reports on a regular cadence so changes are spotted early. The businesses that treat this as routine maintenance, rather than an emergency response, are the ones whose calls keep connecting.

Frequently asked questions

If my calls are "A" rated, why are they labelled spam?

Because labels are driven by reputation signals such as call patterns, complaints and consumer reports, which attestation doesn’t measure.

Can I improve a B or C rating?

Usually by working with your provider to confirm your identity and right to use each number, or by moving to a provider that can sign your calls at A.

How often should we review attestation and reputation?

Attestation whenever numbers or routing change; reputation continuously, with regular reports.