Home > Columns > CRM Columns

STIR-SHAKEN - Helpful, But Still a Bit Unsteady

By Krishna Korlepara, Director of Product Management at Sevis Systems  

“Do not answer the call if you don’t recognize the number.”

The Federal Communications Commission took this well-adopted behavior one step further last year when it passed regulations requiring telephone carriers in the U.S. to identify and flag potential spam callers on their networks. Carriers in the U.S. are required to adopt these mandates, called STIR/SHAKEN, by June 30, 2021.

Americans are avoiding more calls than ever. Studies show that 90% of unrecognized numbers go unanswered. As the rate of spam, fraudulent and robo calls goes up, consumers grow increasingly suspicious of the calls they receive, and by extension, carriers who neglect to properly flag them.

STIR/SHAKEN would bring a little trust back in the relationship between consumer and carrier by mandating carriers to verify outbound calls that are coming from legitimate sources. Once fully implemented, consumers will see a visible checkmark that denotes a valid phone number that’s been verified by a U.S. carrier. It’s a small step in the right direction that will allow consumers to begin to identify the difference between legitimate and spoofed calls through the presence of that verified check.

It’s important to note, however, that this benefit will only be realized after STIR/SHAKEN is fully implemented, which could take years. There are gaps and flaws in these mandates that will continue to pressurize the relationship between consumers, their carriers and the legitimate businesses trying to reach them.

Timeline

The reality is, even after the June 30 deadline for carriers to adopt STIR/SHAKEN mandates it will still take years for those mandates to be fully implemented. Think back to when carriers were working to achieve local number portability—wherein you could take your current local number and take it with you to a new local carrier. That adoption took carriers 10 years. Experts say to expect the same kind of timeline when it comes to STIR/SHAKEN implementation.

Educating the Public

Right now, the existence of verified call checkmarks is sporadic depending on the device and many consumers are unaware that a verified check mark even exists in the instances that it does. For example, Apple devices display a verified call checkmark after the call has already come through and ended, letting the consumer know that the call was legitimate only after that call was ignored or completed. Android devices, however, display a verified check during the call. In either instance, most consumers are still in the dark as to what those checks even mean. 

After carriers implement STIR/SHAKEN, when a consumer receives a call with a check, not only might they not notice it, but how are they to know what that check mark means? The same question exists when there is not a checkmark present at all. There is a lot of education that needs to happen with the public to get them to understand what a checkmark means, the significance it has and how much trust that check provides for the call and in the carrier.

International Calls and Carriers

STIR/SHAKEN mandates place the burden on verification on the outbound side of the call, meaning the carrier that originates the call must be the one to determine if a call is valid and mark it as such. All STIR/SHAKEN mandates are specific to the United States, so those standards do not apply to calls coming into the U.S. from international sources calling via international carriers. The question then becomes, how does the FCC get those international carriers to play ball with U.S. standards? And if they do not or will not, how will those calls be handled to establish trust with Americans on the other end of the line?

Outdated Networks

There is a mass of networks in the U.S. that are outdated and still have time division multiplexing (TDM). Currently, STIR/SHAKEN does not identify a clear path for the carriers operating those older networks to participate in this verification process. This raises the question of whether or not those carriers will be forced to update their networks in order to roll out solutions, which again relates back to the issue of the timeline for this implementation.

Compliancy

It’s not enough for the three or four biggest carriers to implement STIR/SHAKEN. All carriers must be fully compliant in order to realize the full potential of these mandates. Without complete compliance, that leaves gaps in the system and calls that have not been verified or marked as spam to get through to consumers. That includes all telecom carriers and networks in addition to mobile ones.

Device Support

STIR/SHAKEN mandates will mean nothing if consumers are not able to visibly see a checkmark while a call is coming through. All devices will have to be compatible with these regulations, too. Not only does that mean visibility on the phone’s main screen, but also all the other devices where consumers answer their calls, such as on tablets, smart watches, computers or laptops and even in their cars. All would need proper display of that verified check for the mandates to be effective.

Further, there is no guarantee that devices will keep these support services in place. A device manufacturer who today uses checkmarks to verify calls, like Apple and Android, is not mandated to do so, and that complimentary service can be taken away at any time if the device manufacturer decides to remove that function. Without mandating that kind of software exists, the service is not guaranteed on any device.

Mislabeling Legitimate Callers as Spam

In the case of legitimate callers with suspect dialing patterns, for example debt collectors, there is still the risk of being mislabeled as spam. Carriers use specific algorithms to determine the calling patterns of numbers within that carrier. If a number is noted as calling the same number multiple times in a row or calling the same numbers at certain times over consecutive days, the carrier’s systems can flag that number and the carrier can then label it as “Potential Spam” or “Spam Likely” when it calls consumer devices on their network. In the case of preventing robo calling, this is helpful. However, for businesses that rely on different calling patterns to get in contact with consumers, this is potentially a customer experience and employee experience nightmare. Once a number is added to those carrier spam lists, it takes upwards of 3 weeks to have it removed. That’s at least 3 weeks of time wasted that could have been better spent making calls.

Spoofed Calling Still Exists

Perhaps most importantly of the gaps left by STIR/SHAKEN is the fact that high-risk calls will not be flagged as such. That being said, a call coming from a verified number through a legitimate U.S. carrier can still be an unwanted call with potentially dangerous implications if answered. For example, a criminal caller could be calling from a legitimate number. That number will present on the consumer’s phone as verified with a checkmark, denoting to the caller that this is a safe phone call to answer. However, upon picking that call up, the consumer is vulnerable to a scam.

“This is [legitimate bank] calling about your account. We’ve had a security breach and need to verify your contact information. Please provide me your social security number to verify your identity as the account holder.”

STIR/SHAKEN does nothing to prevent or warn the consumer about these calls because the mandates only validate the transport (or the origination and the number) on these calls, not the intent of a call.

While the intentions behind STIR/SHAKEN and the attempts at building back the trust between consumer and telephone carrier are good, there are simply too many areas of fault for this to be the only solution. These areas of concern need to be addressed if we are to continue to build that trust and get good calls answered.