Before a prospect hears a single word from your AI voice agent, their phone has already decided how to introduce you. In the United States, that introduction is shaped by STIR/SHAKEN — a cryptographic caller-ID authentication framework every IP-based voice provider must run. In Australia, it is shaped by something quite different: an enforceable industry code that has telcos tracing and blocking scam calls by the hundred million. Caller authentication is the difference between a call that presents as a legitimate business and one that arrives flagged as a likely scam — or never arrives at all.
What STIR/SHAKEN actually is
STIR stands for Secure Telephone Identity Revisited, the IETF working group and protocol family that lets a caller’s identity be asserted with a signed token (RFC 8224 and RFC 8225, IETF). SHAKEN — Signature-based Handling of Asserted information using toKENs — is the industry framework that deploys STIR across carrier networks, defined by the ATIS/SIP Forum and profiled in RFC 8588 (IETF). In practice: when a call is placed, the originating provider attaches a digitally signed “PASSporT” token asserting the calling number; the terminating provider verifies the signature before the phone rings.
The United States made this mandatory. Under 47 CFR § 64.6301, voice service providers had to fully implement STIR/SHAKEN in their internet protocol networks by 30 June 2021, and the obligation remains in force today: obtain a certificate from a Secure Telephone Identity Certificate Authority and authenticate caller ID on the SIP calls they originate.
Attestation levels: why “A” is the one you want
Signing is not pass/fail. SHAKEN defines three attestation levels, carried in the token’s “attest” field (RFC 8588, formally defined in ATIS-1000074):
- A — Full attestation. The provider knows the customer and can fully attest they are entitled to use the calling number.
- B — Partial attestation. The provider originated the call but cannot fully attest to the calling identity — typically it knows the customer but not their right to the specific number.
- C — Gateway attestation. The lowest level: the provider is merely passing the call from a gateway that does not support the framework, and vouches for nothing about the caller.
For an AI voice agent making outbound sales calls, this matters commercially. Attestation is one of the signals downstream carriers and their analytics engines weigh when deciding how a call is presented, and B- or C-attested traffic starts the conversation with a weaker identity claim — an agent that opens with a clear, well-scripted disclosure still loses if the phone’s screen has already undermined it. The usual root cause of weak attestation is unclear number ownership: shared, resold or unverifiable numbers are hard to A-attest.
The Robocall Mitigation Database — and what changed on 5 February 2026
The FCC’s Robocall Mitigation Database (RMD) is the public register where voice providers certify their STIR/SHAKEN implementation and robocall mitigation programs. It has real teeth: under 47 CFR § 64.6305(g), providers may accept calls directly from a domestic voice service provider only if that provider’s filing appears in the database and has not been de-listed — falling out of the RMD effectively cuts a provider off from the US network.
The rules tightened this year. In a Report and Order (FCC 24-135, published at 91 FR 343), the FCC required RMD filers to take additional steps to ensure the accuracy, completeness and currentness of submitted information, backed by base forfeitures for false or inaccurate filings and for failing to update changed information within ten days. The Federal Register subsequently confirmed the delayed amendments took effect on 5 February 2026, with the first annual recertification due by 1 March 2026 — RMD hygiene is now a recurring annual obligation for every provider carrying your calls. This is separate from the FCC’s still-pending proposal on AI call disclosure, covered in our guide to FCC NPRM 24-84.
Branded calling and Rich Call Data: the emerging layer
Authentication proves the number; it says nothing about who is calling in human terms. The next layer, Rich Call Data (RCD), extends the STIR token so a signed call can carry a verified calling name, logo and call reason. The IETF standardised the PASSporT extension for RCD in RFC 9795 (July 2025), with companion SIP parameters in RFC 9796. Carrier “branded calling” programmes are building on this foundation, but handset and network coverage is still uneven — treat it as an emerging advantage to trial, not infrastructure to depend on. And a branded, A-attested call still has to hold the conversation; that is where sub-second voice AI latency takes over from the network layer.
Australia does it differently
Australia has not adopted or mandated STIR/SHAKEN. The idea has been examined — as far back as May 2022, the ACMA Chair noted an industry initiative “considering whether STIR-SHAKEN protocols are suitable or not to the Australian telecommunications environment” (ACMA speech) — but as at August 2026 no Australian caller-ID cryptographic signing mandate exists.
Instead, Australia runs a code-based enforcement model. The ACMA registers and enforces rules that require telcos to “identify, trace and block scam calls and SMS” (ACMA, Combating phone scams) — the operative instrument being the Reducing Scam Calls and Scam SMs industry code (C661:2022), registered by the ACMA in 2022. The model produces blunt, measurable outcomes: telcos blocked 109.9 million scam calls and 41.1 million scam SMS in the October–December 2025 quarter alone, and over 3.8 billion scams since the rules commenced (ACMA quarterly report). Rather than verifying every caller cryptographically, Australian telcos monitor traffic characteristics and calling-line identification patterns and block what looks like scam origination — so a legitimate AI-agent operation with odd-looking traffic can get swept up if it is careless.
For SMS, Australia has added an identity layer of its own: messages from unregistered alphanumeric sender IDs are now labelled to warn recipients — we unpack the mechanics in our guide to the SMS Sender ID Register. And because number provenance is the foundation of trust in both markets, teams calling Australian prospects should start with our walkthrough of provisioning +61 numbers for AI voice agents.
US vs Australia: what an AI-agent operator faces
| United States — STIR/SHAKEN | Australia — code-based blocking | |
|---|---|---|
| Core mechanism | Cryptographic signing of caller ID on IP calls, mandatory under 47 CFR § 64.6301 | Telcos identify, trace and block scam calls under the ACMA-registered C661:2022 code; no signing mandate |
| Who acts | Originating provider signs with an A/B/C attestation; terminating provider verifies; all providers file in the Robocall Mitigation Database | Carriers and carriage service providers monitor, trace and block; the ACMA enforces the code |
| What the receiving side sees | Verification feeds carrier analytics and display — from verified-call indicators to labels such as T-Mobile’s “Scam Likely” | No verification indicator on voice calls; suspect traffic is typically blocked before it rings; unregistered SMS sender IDs are labelled |
| What an AI-agent operator must do | Use numbers your carrier can A-attest, confirm its RMD filing is current, keep traffic patterns clean | Use properly provisioned +61 numbers with accurate CLI, register SMS sender IDs, keep volumes consistent so blocking heuristics never fire |
Deployment checklist: keeping your AI agent’s calls trusted
1. Prefer numbers you control over shared provider pools. Dedicated numbers in your business’s name are the raw material of A-attestation in the US and clean CLI in Australia; shared or recycled pool numbers carry someone else’s history.
2. Ask your carrier four direct questions. What attestation level will my calls receive, and what do you need from me to reach A? Is your Robocall Mitigation Database filing current, including the 1 March recertification? Do you support Rich Call Data or branded calling? How do I see how my numbers are being labelled downstream?
3. Treat number reputation as an asset with a maintenance schedule. Automation multiplies exposure — multi-channel AI sequencing can drive 28x more contact attempts than a manual team, so a pattern that looks merely enthusiastic from one rep can look like origination abuse from a platform. Ramp new numbers gradually, keep rapid redials and high abandonment out of your agent’s logic, honour opt-outs instantly, and spread volume sensibly across your number inventory.
4. Keep identity consistent across layers. The number, the disclosed business name, the agent’s stated identity and any cloned voice should all resolve to the same organisation — mismatches are exactly what analytics engines and human recipients punish. Our guide to voice cloning compliance on business calls covers the conversational half of that consistency.
5. Monitor how your calls actually display. Test-call handsets on major networks in each market monthly. Remediation paths exist, but they only help if you notice the label before your answer rates tell you.
FAQ
Does Australia use STIR/SHAKEN?
No. As at August 2026, Australia has not mandated STIR/SHAKEN. Its framework is the ACMA-registered C661:2022 Reducing Scam Calls and Scam SMs industry code, which requires telcos to identify, trace and block scam traffic — an approach the ACMA enforces, with telcos reporting blocked scam calls to the regulator quarterly.
Do I need to file in the FCC’s Robocall Mitigation Database to run AI voice agents?
Usually not directly. The database obligations under 47 CFR § 64.6305, as amended effective 5 February 2026, fall on voice service providers and intermediate providers, not on businesses that buy calling services — but your calls depend on your provider’s filing being current, so verify its RMD status before committing volume. If your architecture makes you a voice service provider in your own right, seek advice: the filing duty may be yours.
Will A-attestation stop my calls being labelled “Scam Likely”?
Not by itself. Warning labels are applied by carrier analytics, not by the attestation field alone — T-Mobile, for example, describes Scam Likely as “a caller label that helps warn you when T-Mobile identifies an incoming call as a likely scam” (T-Mobile Scam Shield). A-attestation strengthens your identity claim and helps analytics engines trust the number, but calling behaviour — volume spikes, short-duration bursts, complaint rates — can still earn a label on fully attested traffic.
What is the practical difference between attestation levels A, B and C?
Per RFC 8588 and ATIS-1000074: A (full) means the provider knows the customer and their right to use the calling number; B (partial) means the provider originated the call but cannot fully attest to the calling identity; C (gateway) means the provider is only vouching for having received the call from a gateway. For outbound sales traffic, aim for A — it is the only level that affirmatively ties your business to the number being displayed.
What is branded calling or Rich Call Data?
Rich Call Data extends the signed STIR token so a call can carry a verified calling name, logo and reason for calling, standardised in RFC 9795 (IETF, July 2025). Carrier branded-calling programmes build on it, but handset and network support is still uneven — worth trialling for answer-rate lift, not yet something to architect around.
This article is general information, not legal advice — confirm obligations for your numbers and markets with your carrier and counsel.
Caller authentication is one more layer where outreach done properly beats outreach done loudly. Zian AI’s agents run phone, SMS, email and WhatsApp outreach with SmartReach AI™ pacing channel and timing — consistent, human-plausible calling patterns designed to protect number reputation while the system does the volume. Apply For Partnership — Zian AI is in waitlist beta and onboards new partners by application.