# STIR/SHAKEN and Spam Likely: why good calls get flagged

Source: https://dialmilo.com/hub/stir-shaken-spam-likely
Updated: 2026-11-07

STIR/SHAKEN proves who's calling, not whether the call is wanted. Why signed calls still show Spam Likely, and a checklist to clear and keep your number clean.

STIR/SHAKEN proves a call really comes from the number on the screen. It doesn't decide whether your call gets labelled Spam Likely. That label comes from each carrier's call analytics, which score your number on behaviour: volume, rejected and very short calls, complaints. Signed calls with full A attestation get flagged all the time. To stay clean, call people who expect you, from a number in their country, within sensible hours, with few attempts, and register the number with the analytics companies for free.

If you run outbound calls in the US, sooner or later someone tells you the calls are showing up as "Spam Likely". The usual next question is whether STIR/SHAKEN is the problem. Usually it isn't. It's worth knowing exactly what STIR/SHAKEN does, because the fix for a spam label is somewhere else.

This guide covers US rules as of November 2026, with a short section on the UK.

## What STIR/SHAKEN actually does

STIR/SHAKEN is the US framework for authenticating caller ID. When a call starts, the originating phone company signs it with a digital certificate. The signature travels with the call. The company delivering the call checks it. If the number on the screen was spoofed, the signature won't match.

Large US carriers have had to use it since 2021, and by [Hiya's account](https://blog.hiya.com/successes-and-shortcomings-of-stir-shaken), 30 June 2023 was the FCC deadline for nearly all remaining carrier types.

Two limits matter for anyone making calls:

- **It only works on IP networks.** The signature is lost when a call passes through older, non-IP equipment. In April 2025 the FCC [proposed rules](https://docs.fcc.gov/public/attachments/DOC-411101A1.txt) to close that gap, noting the verification is washed off when "any part of the call path passes through non-IP network technology." Providers would get two years to comply once final rules take effect.
- **It authenticates, it doesn't judge.** As [Genesys's help documentation](https://help.genesys.cloud/248274) puts it, "STIR/SHAKEN alone does not stop illegal spoofing or robocalling", and the terminating carrier, not the attestation, provides the caller ID label.

## The three attestation levels

Every signed call carries one of three levels. The definitions, as Genesys sets them out:

| Level | Name | What the provider is vouching for | Typical cause |
| --- | --- | --- | --- |
| A | Full | "Has authenticated the calling party and they are authorized to use the calling number" | You call from a number your calling provider issued to you |
| B | Partial | "Has authenticated the caller's identity but cannot verify that they are authorized to use the calling number" | You present a number the provider didn't issue, such as one ported elsewhere |
| C | Gateway | "Has validated only the source from which the call was received but cannot authenticate the caller" | The call entered the US network from abroad or through another carrier |

The practical lesson: the simplest way to get full attestation is to call from a number your calling provider actually issued to you. Presenting a number that lives somewhere else is a common route to B. Calls that enter the US from abroad usually arrive as C or unsigned.

To find out what your own calls get, ask your calling provider directly which level it signs your numbers with, and whether anything in the path is non-IP. Then call a few test phones on different carriers. Some phones show a verified mark on authenticated calls; [Twilio's explainer](https://www.twilio.com/en-us/blog/what-is-branded-calling) describes STIR/SHAKEN as able to show a "Caller Verified" indicator. Don't read too much into a missing mark, though. Display depends on the handset and network, and many phones show nothing either way.

Since 18 September 2025, under an FCC order released in November 2024 that [limits third-party authentication](https://vantagepnt.com/news/fcc-limits-third-party-stir-shaken-authentication/), carriers with a STIR/SHAKEN obligation must make their own attestation decisions and sign calls with their own certificate. Attestation now traces back to a provider who is accountable for it.

## Where "Spam Likely" really comes from

The label on the screen is applied by the carrier of the person you're calling, using an analytics partner. The commonly cited pairings, from [Flagman Telecom's summary](https://flagmantelecom.com/spam-labels/) and [Radius Bob's carrier list](https://help.radiusbob.com/en/articles/9663684-preventing-calls-being-flagged-as-spam):

| Carrier | Analytics | Label you'll see |
| --- | --- | --- |
| AT&T | Hiya | "Spam Risk" or "Fraud Risk" |
| T-Mobile | First Orion | "Scam Likely" |
| Verizon | Verizon's own spam feedback system | "Potential Spam" |
| Spectrum | TNS | "Spam Likely" |

The scoring inputs these engines are reported to use are behavioural: how many calls a number makes and how often, how many are unanswered or rejected, very short call durations, the number's history (including a previous owner's), complaints and spam reports, and low attestation from upstream carriers.

That's why a signed call still gets flagged. Hiya's data makes the point bluntly: 89% of mobile calls are fully signed, yet 89% of spam comes from non-mobile lines, and 19% of fully signed non-mobile calls were reported by recipients as unwanted. An A on the call is the entry ticket. Behaviour decides the label.

Number rotation, swapping caller IDs every few hundred calls so no single number collects complaints, is the classic way to "fix" spam labels. Analytics engines look for it, and it makes every number look like a fresh spam operation. If your calls need a fresh number every week, the problem is the list or the pace, not the number.

## Why AI campaigns are at particular risk

AI calling makes it easy to dial a lot of people very quickly, which is exactly the pattern the scoring engines punish. Three things go wrong most often:

**Too many calls from one number in a short window.** An AI agent can run dozens of calls at once. A new number that suddenly makes 2,000 calls in an afternoon looks like a robocaller, whatever the calls say.

**Lots of very short calls.** If the first two seconds of your call are silence while a system decides whether a person or a machine answered, people hang up. Those two-second calls look like spam to an algorithm. In our own pilot with an online casino operator in October 2026, keeping the pause after pickup under a second was one of the clearest lessons: Milo starts speaking almost straight away while it keeps listening for a voicemail greeting.

**Calling people who don't expect it.** Cold lists drive rejections and complaints. Consent-based lists, people who registered, bought or asked to be contacted, don't. Who you're allowed to call with an AI voice is a legal question as well as a reputation one; see [AI phone call laws](/hub/ai-phone-call-laws). The FCC [confirmed in February 2024](https://docs.fcc.gov/public/attachments/DOC-400393A1.pdf) that AI-generated voices count as "artificial" under the TCPA.

## A checklist to keep your number clean

  
    The [Free Caller Registry](https://www.freecallerregistry.com/fcr/) submits your numbers to First Orion, Hiya and TNS in one form, for free. It notes registration "does not guarantee redress", but it's the analytics companies' own channel and costs nothing.
  
  
    That's the cleanest route to full attestation in the US. For other countries, use a local number the person will recognise; see [numbers in other countries](/help/numbers-in-other-countries).
  
  
    Cap the number of calls running at once and per hour, especially on a new number. Dial Milo lets you set calls at the same time (1 to 50) and a maximum per hour, and change them while the campaign runs.
  
  
    Two attempts a few hours apart is plenty for most lists. A cooldown across campaigns, so nobody is called twice in a week, stops your different campaigns from adding up. See [calling hours and contact limits](/help/calling-hours-and-contact-limits).
  
  
    A call at 08:15 or 21:30 is how complaints start. Set calling hours and make sure they apply in each person's time zone, not yours.
  
  
    Say it's an AI and who it's calling for. When someone says "stop calling", record it and never call again. Opt-outs you ignore turn into complaints, and complaints drive labels.
  

## How to tell you've been labelled

You usually find out from the numbers before anyone tells you. Answer rates drop sharply on one carrier or across the board, and calls that used to connect start failing or getting rejected.

Dial Milo watches this for you. It checks the last 20 finished calls on each campaign and pauses the campaign by itself, with an email, if none of them connected (voicemail counts as connected) or 15 or more failed or were rejected. Your list stays queued, so you can sort out the number and press Resume. The details are in [running an outbound campaign](/help/running-an-outbound-campaign).

**Worked example (illustrative figures).** Say a campaign normally gets 30 conversations per 100 dials. On Tuesday afternoon that drops to 4. Before blaming the script, split the results by the carrier of the number called. If AT&T numbers are at 2 and everyone else is normal, one analytics engine has probably labelled you. Check your number on that carrier's correction form, slow the campaign down, and look at what changed that day: a bigger list, a new segment, more attempts.

## Clearing a label

1. **Stop or slow the calls from that number** so the score has a chance to recover.
2. **Submit corrections.** Use the Free Caller Registry and each carrier's own process; Radius Bob's list links the T-Mobile, Verizon and AT&T forms.
3. **Fix the cause.** Usually a list with too many people who didn't expect the call, too many attempts, or a burst of volume. Otherwise the label returns.
4. **Consider branded calling only after that.** It can make a clean call recognisable, but it won't rescue a number with a bad record. See [branded caller ID](/hub/branded-caller-id) for what it costs and where it shows.

## Outside the US

STIR/SHAKEN is a North American system. In the UK, the equivalent pressure comes from Ofcom's caller line identification rules. Since 29 January 2025, networks are expected to block calls from abroad that present a UK number, except in limited cases such as a provider being able to show the call is made by a UK customer, as [Comms Council UK summarises](https://commscouncil.uk/press/ofcom-updated-cli-guidance-tackling-scam-calls/). The ICO separately requires marketing callers to [display a number](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/). If you call UK players or customers, use a UK number you're entitled to present. For gambling operators, the [UKGC rules on marketing calls](/hub/ukgc-marketing-call-rules) add their own layer.

This isn't legal advice. It reflects US and UK rules as we understand them as of November 2026. Telecoms rules change, so check with your provider or a lawyer before a large campaign.

The short version: STIR/SHAKEN keeps your number from being impersonated. Keeping it from being labelled is your job, and it comes down to who you call, how often and how fast. For how all of that fits into a campaign, start with [AI outbound calling](/hub/ai-outbound-calling).

## Frequently asked

**What is STIR/SHAKEN in simple terms?**

It is a caller ID authentication system used by US phone networks. The network that starts a call signs it with a digital certificate saying how sure it is that the caller is allowed to use that number. The network delivering the call checks the signature. It proves the number was not spoofed. It says nothing about whether the call is wanted.

**What do A, B and C attestation mean?**

A, full attestation, means the originating provider knows the customer and knows they are authorised to use the calling number. B, partial, means it knows the customer but cannot confirm the number is theirs. C, gateway, means it only knows where the call entered its network, typically calls arriving from abroad or from another network.

**Why does my call show Spam Likely if it has A attestation?**

Because the label does not come from STIR/SHAKEN. It comes from call analytics run for each carrier, which score a number on how it behaves: how many calls it makes, how many are rejected or very short, and how many people complain. A perfectly signed number that dials thousands of people who hang up after two seconds can still be labelled.

**How do I remove a Spam Likely label?**

Register your numbers through the Free Caller Registry, which covers First Orion, Hiya and TNS in one submission, and use each carrier's own correction form where one exists. Then change what caused the label, usually volume, poor lists or too many attempts, or the label tends to come back.

**Does STIR/SHAKEN apply in the UK?**

No. STIR/SHAKEN is a US and Canadian requirement. The UK relies on Ofcom's caller line identification rules, which since January 2025 ask networks to block calls from abroad that present a UK number unless the provider can show a legitimate UK customer is behind them.