What Is STIR/SHAKEN? The Caller ID Fix That Protects Seniors From Scam Calls

If you've ever seen "Scam Likely" pop up on your parent's phone instead of an unfamiliar number, you've seen STIR/SHAKEN at work — even if you didn't know it by that name.

STIR/SHAKEN (the acronym stands for Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) is a framework the FCC mandated in 2021 that addresses one of the most exploited weaknesses in the phone system: the ability to fake caller ID.

Understanding what this technology does — and, critically, what it doesn't do — helps you set realistic expectations for how protected your parent actually is when the phone rings.

Why Caller ID Was Broken in the First Place

The traditional phone system was designed in an era when only a few large carriers had access to it. Caller ID was treated as trustworthy by default because manipulating it required access to carrier-level infrastructure that ordinary criminals couldn't obtain.

That assumption stopped being valid long ago. VoIP (Voice over Internet Protocol) technology made it trivially easy and cheap to make calls over the internet and assign any caller ID you wanted — including numbers belonging to real banks, government agencies, or even the victim's own family members.

This is how a scammer based in a call center in Southeast Asia can make a call that appears to come from the Social Security Administration's legitimate phone number, your parent's actual bank, or even from a local area code designed to trick them into answering.

What STIR/SHAKEN Actually Does

STIR/SHAKEN is essentially a digital signature system for phone calls.

When a call originates on a carrier's network, the carrier signs the call with a digital certificate — like a stamp of authenticity. That signature travels with the call through the network. When the call arrives at the destination, the receiving carrier can verify the signature and confirm that the caller ID has not been modified in transit.

If the call's caller ID matches the signature: the call gets an "A" attestation level — indicating the carrier fully verified the caller's identity.

If the caller's identity can be confirmed but not the specific number: a "B" attestation.

If the call is just being passed through without verification: a "C" attestation.

Your phone or carrier then uses this attestation level to inform what you see on screen. A call with a "C" attestation from an unknown number is far more likely to be labeled "Scam Likely" or screened out. A call from your bank with an "A" attestation is more likely to display normally.

What STIR/SHAKEN Doesn't Do

This is where honest expectations matter for protecting your parent.

It doesn't stop all spoofing. STIR/SHAKEN only works when all carriers in the call's path support it. Many international carriers and some smaller domestic carriers are not fully implemented. Scammers can route calls through unsupported networks to avoid the verification step entirely.

It doesn't verify who you're actually talking to. STIR/SHAKEN confirms that the number displayed is the one the call actually came from — but it doesn't confirm the identity of the person on the line. A scammer could have a verified US-based number and still impersonate Medicare or the IRS.

It doesn't stop every labeled "Scam Likely" call from getting through. It reduces them — it doesn't eliminate them. Many scam calls still reach seniors' phones; they're just labeled differently, and an older adult who doesn't understand what "Scam Likely" means may answer anyway.

It doesn't address text message scams (smishing). STIR/SHAKEN only applies to voice calls. The flood of fraudulent text messages — fake package delivery notices, fake toll road charges, fake bank alerts — is an entirely separate threat with its own mitigation tools.

What "Scam Likely" Means on Your Parent's Phone

When your parent sees "Scam Likely," "Fraud Risk," or "Spam Risk" on their caller ID, that label is generated by their carrier using STIR/SHAKEN data combined with their own fraud detection algorithms. T-Mobile, AT&T, and Verizon all deploy these labels as part of their STIR/SHAKEN implementation.

The label means the carrier has reason to believe this call may be fraudulent. It should not be answered. The rule to teach your parent: if you don't recognize the number and the phone says "Scam Likely," let it go to voicemail. Legitimate callers leave messages.

However, "Scam Likely" labels are not exhaustive. A call can be fraudulent without being labeled as such, especially if it's routed through networks that haven't fully implemented STIR/SHAKEN verification.

What Actually Protects Your Parent: A Layered Approach

STIR/SHAKEN is a useful layer of defense, but it's one layer among several. Here's what a complete phone-based protection setup looks like for an older adult:

Enable "Silence Unknown Callers" on iPhone. Go to Settings > Phone > Silence Unknown Callers and toggle it ON. Any number not in the contacts list is automatically sent to voicemail. This is the single highest-impact change you can make on an iPhone — it eliminates the opportunity for scammers to speak with your parent directly.

Enable Call Screen on Android (Google Pixel). Google Assistant answers unknown calls and asks the caller to state their name and purpose. Your parent sees a text transcript and decides whether to answer. Samsung devices have a similar feature called Smart Call.

Consider a third-party call-blocking app. Apps like Nomorobo ($1.99/month) and RoboKiller maintain constantly updated databases of known scam numbers and block them before they even ring. These services work on top of the carrier-level STIR/SHAKEN protections and catch numbers that carriers haven't yet flagged.

Register on the Do Not Call Registry. Go to donotcall.gov and register your parent's phone number. This won't stop criminal scammers who ignore the registry, but it reduces the volume of legitimate telemarketing calls — which makes the illegitimate calls easier to identify.

Establish a household rule: never give out information on an incoming call. If a caller claims to be from the bank, Social Security, or Medicare and asks for any information, the correct response is to hang up and call back on the official number. The original caller's identity cannot be verified regardless of what caller ID shows.

The Bigger Picture

STIR/SHAKEN represents meaningful infrastructure progress — it's made it significantly harder for scammers to spoof major government and bank numbers without carrier detection. But it was never designed to be a complete solution, and the fraud industry adapts quickly. Criminals simply shifted to using real, verified US numbers registered to shell entities, or routing calls internationally.

The most effective protection your parent has is not technical — it's behavioral. A parent who understands that no government agency, bank, or Medicare program will ever demand immediate payment over the phone, and who knows to hang up and call back on official numbers, is safer than any call-filtering technology alone.

The Elder Scam Shield guide lays out the full protection system: the technical tools, the behavioral habits, the financial safeguards, and the scripts for making these protections feel empowering rather than patronizing. STIR/SHAKEN is a good start. A layered defense is what actually keeps your parent safe.