STIR/SHAKEN is the system U.S. phone carriers use to check that the caller ID on a call is real. For insurance agents, it affects whether a call shows a verified number. It does not decide whether the call is answered, labeled as spam or blocked. This guide explains how the system works, what the A, B and C attestation levels mean, and what an agent or agency can do to keep legitimate calls from being treated like robocalls.
TL;DR
- STIR/SHAKEN lets the originating carrier sign a call and the receiving carrier verify it. It targets caller ID spoofing.
- Attestation comes in three levels. A is the strongest: the carrier knows the customer and has verified the right to use the number.
- Authentication does not guarantee delivery. Carriers and call-blocking apps still decide whether to label or block a call.
- Insurance agents control the parts that matter most: number ownership, calling consent, message content and call volume per number.
- Agents get most of the benefit by using a phone provider that signs calls and by following consent rules.
Table of Contents
- What STIR/SHAKEN is
- How the process works on an outbound call
- The three attestation levels
- Why authenticated insurance calls still get flagged
- Why consumers get so many insurance spam calls
- What insurance agents can do
- Our perspective
- How CallBack fits
- FAQ
- Sources
What STIR/SHAKEN is
The FCC describes STIR/SHAKEN as a caller ID authentication framework for IP voice networks. The originating carrier digitally signs the caller ID information it is asserting. The receiving carrier verifies that signature before the call reaches the person being called.
The FCC also spells out the name. STIR stands for Secure Telephone Identity Revisited. SHAKEN stands for Signature-based Handling of Asserted Information Using toKENs.
The goal is to fight illegal caller ID spoofing. Spoofing is when a caller shows a number that is not theirs. Scammers use it to look local or to look like a trusted company. Insurance is a common theme for these calls, so legitimate insurance callers often get grouped with them.
How the process works on an outbound call
A short version of what happens when an agent places a call from a business phone system:
- The agent’s phone system sends the call to a voice provider.
- The provider decides how much it knows about the customer and the number, and assigns an attestation level.
- The provider signs the call. Twilio explains that the caller ID information is added to the SIP header and signed as a JSON web token.
- Downstream carriers verify the signature. They can then decide whether to route the call, label it or reject it.
The legal basis is 47 CFR 64.6301. It requires covered voice providers to authenticate caller ID for SIP calls they originate, pass the authenticated information along when technically feasible, and verify it on calls they receive.
The rule applies to providers, not to individual agents. An agent does not sign calls. The agent’s phone provider does. That makes the choice of provider and the way the agent sets up numbers the practical lever.
One limit applies. The FCC notes that STIR/SHAKEN works only on IP networks. Calls that cross older network technology may lose the signature on the way.
The three attestation levels
The attestation level is the part agents see most in practice. FCC Order 24-120 describes the levels this way:
| Level | Name | What the provider knows |
|---|---|---|
| A | Full | The provider originates the call, knows the customer and has verified the customer’s right to use the number. |
| B | Partial | The provider knows the customer and originates the call but cannot verify the number shown. |
| C | Gateway | The provider is only the entry point to the network and has no relationship with the caller. |
A is the level an agent wants. It shows the number was verified against the account making the call.
The ATIS best practices recommend A attestation only when the caller is authorized to use the number shown. They recommend B or C when the number has not been validated. They also recommend third-party validation if a provider cannot or will not validate numbers itself.
What drops an agent to a lower level
Common situations include:
- Showing a number the phone account does not own, such as a personal cell phone number on a business dialer.
- Using a number rented from another source without the provider confirming the agent’s right to it.
- Routing calls through several providers, so the last carrier has no direct relationship with the caller.
- Using a mix of numbers across a team without registering each one with the account.
In each case the fix is the same. The numbers shown on outbound calls should belong to the account and be set up with the provider that places the call.
FCC rules also allow a provider to use a third-party authentication service. The provider still makes the attestation decisions, requires calls to be signed with its own certificate and keeps the agreement on file for two years after it ends. Agents do not manage this directly, but it explains why the provider’s setup matters.
Why authenticated insurance calls still get flagged
Many agents see this: calls are signed with A attestation, yet the phone shows “Spam Likely.” This is expected behavior, not a fault.
The FCC states that STIR/SHAKEN supports call blocking and call labeling. It does not promise that a call will go through or appear without a warning. The ATIS FAQ is direct on this point: the framework is not a silver bullet and does not itself block calls. It improves the information available to blocking apps and to consumers.
Those apps and carrier tools then rate calls. ATIS says verified caller ID information can be passed to call-blocking applications that rate calls as good, questionable or likely fraudulent. The rating usually depends on behavior and reputation, such as:
- How many calls a number places in a short time.
- How many calls go unanswered or end within a few seconds.
- How often recipients report or block the number.
- How closely the number matches known spam patterns.
A signed call from a number that dials hundreds of leads a day with short hang-ups can get a spam label. Authentication proves where the call came from. It says nothing about whether recipients want it.
Authentication is not proof of who is calling
STIR/SHAKEN also does not prove that the caller is the business or person named. FCC material states that a number can be permissibly spoofed in some circumstances. It also discusses presenting a main contact number instead of a number used only for outbound calls. A verified number means the provider verified the number’s link to an account. It does not mean the call is lawful or that the telemarketing rules were followed.
This matters for insurance. Verified calling does not replace consent. Agents still need written consent for marketing calls and texts under the Telephone Consumer Protection Act. The CallBack guide on insurance sales sequences and a TCPA checklist covers how to structure follow-up with consent in mind.
Why consumers get so many insurance spam calls
People searching this topic often come from the consumer side, so the cause is worth stating. Insurance calls come from two groups: scammers who spoof numbers, and licensed sellers who call people who filled out a form.
The second group is larger than many people expect. A privacy-focused guide on health insurance calls explains that quote request pages often carry broad consent language. A single submission can be shared with many brokers, who may then all call. That is why one request can lead to calls from companies the person has never heard of.
For a consumer receiving unwanted or spoofed calls, the FCC runs a complaints center for unwanted calls and texts. It also has a path for people whose own number is being spoofed or labeled as spam.
For agents, the lesson is that a call may be legal and still look unwelcome. The way to avoid being lumped in with scams is to call people who expect the call, and to make that expectation clear at the point of lead capture.
What insurance agents can do
The steps below reduce spam labeling. None of them guarantees a result, because carriers and apps set their own rules.
1. Use numbers the account owns
Show only numbers that belong to the phone account placing the call. Avoid showing a personal mobile number from a business dialer. This is the main factor in whether the provider can give A attestation.
2. Match the number to the business
Use a main business number or a dedicated local number that people can call back and reach the agency. FCC discussion of presenting a main contact number points the same direction: a callback number that reaches the business is more credible than one that only dials out.
3. Spread volume sensibly
A single number placing very high daily volume looks like robocalling. Use enough numbers for the size of the team, and keep each number’s activity in line with normal one-to-one calling.
4. Call leads who asked to hear from you
Speed to contact matters, but so does consent. Keep consent records for each lead source. Remove numbers that ask to stop. Fewer complaints help a number’s reputation.
5. Use text and voicemail along with calls
A short text before or after a call can tell the lead who is calling. A voicemail that names the agent and agency gives the recipient a reason to trust the number. Messages should use carrier-approved wording and avoid repeating identical content to many recipients.
6. Watch the labels
Test by calling a few phones on different carriers and see how the number displays. If a number gets labeled, retire or rest it and review how it was used. A strong online review profile also helps people recognize the agency. See the CallBack article on reputation management for insurance agents.
Our perspective
We build CallBack for insurance agents, and the same pattern comes up often. Agents treat caller ID authentication as the whole answer to missed calls. It is one input. Number setup, consent, message content and volume matter as much.
We also see agents lean too heavily on cold calling. It costs time, and it is the activity most likely to trigger spam labels. We build the platform around follow-up that starts after a lead asks for contact: automated SMS, email and voicemail, with calls placed when a lead responds.
On deliverability, we use unique message hashing, iMessage delivery where available and carrier-approved wording. These practices cover text messaging, which STIR/SHAKEN does not. STIR/SHAKEN applies to voice calls only. Texts follow different carrier registration and filtering rules.
Our advice is plain. Keep numbers in the agency’s name. Keep consent records. Contact leads quickly and with a reason. Treat a spam label as feedback about calling behavior, not only a technical error.
— Kyle
How CallBack fits
CallBack is a CRM and sales automation platform for insurance agents, agencies and IMOs. It combines pipelines, automated follow-up by SMS, email and voicemail, calling, and reporting in one account. The Professional plan costs $97 per month, and phone numbers cost $2.30 per month per number. Enterprise plans start at $297 per month for 10 full CRM accounts. Usage fees for calls, texts and email are listed on the fees page. Agents who want to try it can start on the Professional plan. The SMS marketing features explain how text follow-up works.
For agents building a lead flow that relies less on cold dialing, the CallBack guide to insurance lead generation that converts is a useful next step.
FAQ
What is STIR/SHAKEN caller ID?
It is a framework that lets carriers confirm a call’s caller ID is genuine. The originating carrier signs the call, and the receiving carrier checks the signature. It is meant to stop caller ID spoofing on IP networks.
Does STIR/SHAKEN stop my insurance calls from being marked as spam?
No. It verifies the source of a call but does not control labeling. Carriers and call-blocking apps rate calls on their own, using call volume, answer rates and consumer reports along with the authentication result.
Which attestation level should an insurance agent aim for?
A, or full attestation. It means the provider knows the customer and has verified the right to use the number shown. Calling from numbers owned by the phone account is the main way to get there.
Does a verified call mean the call is legal?
No. Authentication shows where a call came from, not whether the caller had consent. Marketing calls and texts to consumers still need to follow TCPA rules and the agent’s own consent records.
Why do I get so many spam calls about insurance?
Some come from scammers using spoofed numbers. Many come from licensed sellers who received your number through a quote form with broad consent wording. Reporting the calls to the FCC and reading consent language before submitting forms can help.
Sources
- FCC: Combating Spoofed Robocalls with Caller ID Authentication
- eCFR: 47 CFR 64.6301, Caller ID authentication
- FCC Order 24-120
- ATIS: SHAKEN Frequently Asked Questions
- ATIS: Best Practices for the Implementation of Call Authentication
- FCC document 25-76 on caller ID and spoofing
- Twilio: Voice Calls 101
- FCC Consumer Complaints: Unwanted Calls/Texts
- Incogni: How to stop health insurance calls