A flashing caller ID display that names a local utility, a court clerk, or your own bank once carried weight. For years, bad actors manipulated that text with simple web software, pretending to ring from down the block while sitting thousands of miles away. Congress tried to intervene with the Pallone-Thorkildsen Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, known as the TRACED Act, in 2019. That law directed the Federal Communications Commission to push telecom providers toward technical standards meant to confirm where a call originated. Yet the phone still rings with unwanted calls, leaving many people wondering what changed and why faked caller numbers continue to slip through.
Why Lawmakers Pushed for Call Authentication
Unwanted telemarketing and outright scams have sat at the top of official complaint lists for years. According to the U.S. Government Accountability Office (GAO), robocalls and other unwanted calls consistently rank among the top consumer grievances filed with federal regulators. The Federal Communications Commission (FCC) reported similar patterns, where automated dialers and forged numbers overwhelmed residential lines and mobile phones alike.
To tackle the problem at the network level, the TRACED Act told the FCC to require voice service providers to adopt technical authentication measures, primarily a framework called STIR/SHAKEN. The basic goal was simple: ensure the carrier that launched a call attached an electronic stamp proving its network of origin. While the law set the mandate in motion, the precise FCC implementation orders, compliance deadlines, and complex legal challenges remain detailed in official regulatory dockets rather than top-level statutory summaries. Readers following the legal status of specific carrier requirements should consult published FCC orders directly.
How STIR/SHAKEN Signing Works in Plain Terms
STIR/SHAKEN acts like a digital passport control system for voice traffic. STIR stands for Secure Telephone Identity Revisited, while SHAKEN stands for Signature-based Handling of Asserted information using toKENs. When someone dials a number, the originating voice provider attaches a cryptographically signed token to the call data. This token travels across interconnected networks to the receiving phone company, which inspects the signature to see if the call was altered along the way.
A core element of this framework is the attestation level, which rates how well the originating provider knows the caller and the number being displayed:
- Level A (Full Attestation): The phone provider knows the customer making the call and has verified that the customer has the legal right to use the specific telephone number displayed on the caller ID.
- Level B (Partial Attestation): The provider recognizes the customer initiating the call, but it cannot independently verify that the customer is authorized to display that particular phone number.
- Level C (Gateway Attestation): The provider only knows where the traffic crossed into its network from an outside connection, with no visibility into who started the call or whether they own the caller ID number.
These ratings provide network context rather than a verdict on morality. A call signed with Level B or Level C is not automatically marked as spam or blocked, because legitimate enterprises like hospital switchboards or centralized call centers often route outbound lines through third-party connections. More importantly, an A-level signature only confirms that the caller has permission to use the number. It does not verify the caller's character, intentions, or honesty.
Why Number Spoofing and Scams Persist
Because STIR/SHAKEN verifies the technical link between a caller and a number rather than human behavior, it leaves obvious avenues open for fraud. A criminal enterprise can purchase legitimate phone numbers, acquire valid service contracts, and make outbound calls with an A-level attestation. The signature passes inspection because the registration is real, even if the person speaking intends to mislead the person who picks up.
Tactics have also adapted as carrier defenses evolved. Industry materials from USTelecom report that illicit operations have shifted away from foreign internet-based voice networks toward domestic hardware known as SIM boxes. These physical devices house multiple cellular subscriber identity modules (SIM cards) to route traffic directly across major wireless networks, masking overseas originators behind local wireless infrastructure. Scam groups have also moved away from untargeted high-volume automated robocalls, turning instead to targeted spear-phishing that incorporates personal data gathered from social media or data breaches.
To address these physical and network-level evasion tactics, industry groups coordinate enforcement through the Industry Traceback Group, which the FCC designated as the official U.S. Traceback Consortium under the TRACED Act. This consortium coordinates with carriers, financial institutions, and federal law enforcement to trace suspect call paths back to their source and shut down hardware setups like unauthorized SIM banks. Still, this work operates as a reactive investigative layer rather than an automatic technological barrier.
Evaluating Claims and Data Gaps
When assessing how well these anti-spoofing systems work, it helps to scrutinize who provides the numbers. Much of the publicly circulated information comes directly from vendors and telecommunications trade associations that have an interest in demonstrating regulatory success. For example, trade materials cite figures claiming scam robocalls have dropped by more than 80 percent from historic peaks. However, this is an advocacy estimate; independent government datasets validating that exact national decline are not included in public disclosures.
Similarly, technical guides explaining how receiving carriers use attestation levels to block or label calls often come from software vendors that acknowledge carrier analytics remain proprietary. How an individual wireless carrier decides to display an incoming call as "spam risk" involves private algorithms rather than public regulatory rules. Public federal records like the FTC's Annual Do Not Call Registry Data Book and complete GAO research provide raw consumer complaint volumes, but they do not provide a real-time count of total unauthorized calls traveling through private networks. The current progress of proposed enforcement updates, such as the Robocall Trace Back Enhancement Act, also requires tracking current congressional records.
Protective Steps for Inbound Calls
Because caller ID displays and network signatures cannot reveal who is sitting on the other end of the line, you should never treat incoming caller information as proof of identity. If someone calls claiming to represent your financial institution, an electric utility, or a court, the most protective response is to disconnect. Look up the organization's verified phone number on an official statement, the back of a payment card, or a secure online portal, and dial that number directly.
Legitimate organizations rarely call unannounced demanding immediate payment, gift cards, wire transfers, or temporary one-time security passcodes. If an unknown caller asks for sensitive account details, end the conversation immediately. To verify official steps for reporting suspicious calls or logging an unauthorized contact, consult the official consumer complaint portals maintained directly by the Federal Trade Commission and the Federal Communications Commission.
