Technology

STIR/SHAKEN

Caller ID authentication framework US voice carriers must deploy against spoofing.

Attackers spoofed Astrana Health's main phone number to get in, and the company told the US stock-market regulator on 23 September 2026 that the breach was material, despite STIR/SHAKEN checks required of US carriers since 2021.

Last refreshed: 12 October 2026

Key Question

Why can a spoofed company phone number still get past caller ID?

Timeline for STIR/SHAKEN

#14 23 Sept

Mentioned in: Astrana Health files 8-K over phone spoof

Cybersecurity: Threats and Defences

View full timeline →

Background

STIR/SHAKEN is the caller ID authentication framework that the US Federal Communications Commission requires voice providers to run. It failed to stop callers faking Astrana Health's main number while posing as staff in 2026.

An FCC order of 31 March 2020, issued under the TRACED Act, told every voice service provider to deploy STIR/SHAKEN in the IP parts of its network by 30 June 2021. The framework rests on internet standards written by the IETF's Secure Telephone Identity Revisited working group. Networks that do not carry calls over IP were left to separate measures.

A call that crosses any network outside the STIR/SHAKEN framework can still arrive with a forged number.

Common Questions

What is STIR/SHAKEN?

The caller ID authentication framework the FCC requires US voice providers to use against illegal number spoofing.Source: FCC Report and Order FCC 20-42

When did STIR/SHAKEN become mandatory?

The FCC required voice providers to implement it in the IP parts of their networks by 30 June 2021.Source: FCC Report and Order FCC 20-42

Can STIR/SHAKEN stop all spoofed calls?

No. Calls crossing networks outside the framework, including non-IP networks, can still show a forged number.Source: FCC Report and Order FCC 20-42