If your agents sit in Manila, Bogotá, Cape Town or Lisbon and call customers in the United States or Canada, STIR/SHAKEN decides how your calls are labelled before anyone picks up. Many offshore centres assume the framework only applies to US carriers. It applies to every call that enters the US network, and the way your calls enter determines how much trust they carry. Here is what you need to know.
Key takeaways
- STIR/SHAKEN applies to every call terminating on US and Canadian IP networks, wherever it started.
- Foreign-originated calls are signed by the US gateway provider, often at the lowest attestation level, C.
- Higher attestation depends on the signing provider knowing you and verifying your right to the number.
- Every provider handing traffic to US networks should be listed in the Robocall Mitigation Database.
- Stable, registered numbers with good consent and answered callbacks matter as much as attestation.
On this page
STIR/SHAKEN in one minute
STIR (Secure Telephone Identity Revisited) is a set of IETF standards for cryptographically signing the caller ID of a SIP call. SHAKEN (Signature-based Handling of Asserted information using toKENs) is the framework that US and Canadian carriers use to deploy it. The originating provider signs each call with a certificate and adds the signature to a SIP Identity header. The terminating provider verifies the signature and uses the result, along with its own analytics, to decide whether to display the call normally, label it, or block it.
The three attestation levels
| Level | Meaning | Typical effect |
|---|---|---|
| A — Full | Provider knows the customer and has verified they may use the calling number | Best chance of normal display |
| B — Partial | Provider knows the customer but cannot verify the number | More likely to be labelled |
| C — Gateway | Provider is passing the call on from somewhere else, usually abroad | Least trust; labelling and blocking more likely |
Attestation is not a pass/fail stamp. Terminating analytics combine it with call patterns, complaint data and number reputation. But it sets the starting point, and an offshore call that arrives as C attestation starts with a handicap.
Why offshore traffic often ends up as C
Calls that originate outside North America enter the US through a gateway provider, the first US-based carrier in the path. FCC rules require gateway providers to authenticate unauthenticated foreign-originated calls that present a US number, to register in the Robocall Mitigation Database, to know their upstream customers, and to block traffic from providers that are not listed. A gateway that knows nothing about the original caller can only sign with C.
The way out is for the provider that signs the call to have a direct, verified relationship with you and with the numbers you present. When that provider has onboarded you, holds evidence that you are authorised to use your US numbers, and is itself a registered provider, it can sign your calls at a higher level.
The Robocall Mitigation Database
The FCC's Robocall Mitigation Database (RMD) lists voice providers that have certified their STIR/SHAKEN implementation status and filed a robocall mitigation plan. US intermediate and terminating providers must refuse traffic directly from providers that are not listed. Since the FCC extended the obligations to all providers, including non-gateway intermediates, a foreign voice provider that hands traffic straight to US networks needs an RMD filing.
As a call centre you normally do not file yourself; your carrier does. What you should do is confirm that every provider in your US path is listed and ask how your calls are attested. CLIRoutes routes North American traffic only through registered partners.
Canada
The CRTC required Canadian providers to implement STIR/SHAKEN on IP networks, and the Canadian Secure Token Governance Authority (CST-GA) administers certificates. Canadian networks also display a verification indicator on some devices and run call-blocking based on attestation and analytics. The practical rules for offshore centres are the same as for the US. See CLI routes to Canada.
A checklist for offshore call centres
Inventory your CLIs
List every US and Canadian number your agents present, who holds it, and the documentation that proves it.
Register numbers with analytics providers
Use the free registration portals the major US analytics engines offer to associate your numbers with your business name.
Choose a carrier that can attest your calls
Ask directly: which entity signs my calls, at what level, and is every provider in the path listed in the RMD?
Limit numbers per campaign
Use a stable set of numbers tied to a brand and a campaign. Stable, recognisable numbers build reputation over time.
Monitor labelling
Test-call your own numbers on the main US mobile networks weekly and record how they display.
Honour consent and DNC
Complaint data is the strongest input into labelling. Calling hours, DNC scrubbing and opt-outs matter as much as attestation.
What the Identity header contains
The signing provider creates a PASSporT, a signed JSON Web Token, and carries it in the SIP Identity header. It contains the calling number, the called number, the attestation level, a timestamp and a unique origination identifier (origid) that lets the call be traced back to the signer. The certificate URL tells the terminating provider where to fetch the public key to verify the signature.
{
"attest": "A",
"dest": { "tn": ["15125550134"] },
"iat": 1793955600,
"orig": { "tn": "12125550199" },
"origid": "8a1c7e9b-4f2d-4b3a-9e61-2f0c9d7a5b11"
}You do not need to generate this yourself; your carrier does. But being able to read it in a SIP capture tells you instantly what level your calls are receiving, and whether a carrier in the path has stripped the header.
Traceback and why it matters to you
When a call is reported as illegal, the industry traceback group follows it hop by hop to the originating provider. Providers that fail to respond, or that are found to carry illegal traffic repeatedly, can be removed from the Robocall Mitigation Database, after which US networks must refuse their traffic. For a call centre, the practical consequence is simple: if a provider in your path is careless about the traffic it accepts from others, your legitimate calls can be blocked along with theirs.
That is why the onboarding questions a good carrier asks you, about your business, your numbers and your campaigns, protect you as much as them. They are what allows the carrier to answer a traceback quickly and keep the route open.
Common misunderstandings
- "A attestation means my calls will never be labelled." Analytics still weigh complaints and calling behaviour.
- "Offshore calls cannot be signed." They can be signed by a provider that knows the customer and the numbers; the gateway rules address unsigned foreign traffic.
- "STIR/SHAKEN only matters for robocalls." It applies to every call terminating on US and Canadian IP networks, including agent calls.
Choosing US numbers for an offshore centre
Use numbers your client holds for its own customers whenever you call on a client's behalf, with a letter of authorisation that allows you to present them. When you need numbers of your own, obtain US DIDs from a carrier that will also carry your outbound traffic, so the signing provider has a direct record of the assignment. Keep the set small and stable, register each number with the main analytics engines against the brand name the recipient will recognise, and make sure every number rings somewhere useful when customers call back. A number that goes unanswered on callback is reported far more often than one that reaches a person or a clear IVR.
Avoid frequently changing the numbers you present to get around labelling. Analytics engines detect new numbers with no history making high volumes of calls, and treat that pattern with suspicion. Stable numbers, good consent and answered callbacks are the durable fix.
How CLIRoutes handles US and Canadian traffic
We verify your CLI ownership during onboarding and route North American traffic through partners that are registered in the RMD and sign calls based on that verified relationship. Your portal shows which numbers are approved for US presentation. Calls that present unapproved US numbers are rejected before they leave our network, which protects the reputation of everyone using the route.
For more on number formats and regulator rules elsewhere, see CLI Rules by Country and the United States CLI routes page.
About the author
Priya Natarajan, Compliance Lead
Priya leads customer onboarding, caller-ID authorisation and campaign review. She previously worked on numbering and consumer-protection policy for a European telecoms operator.
Published · Last reviewed