STIR/SHAKEN Compliance Stalls at 42%: What the FCC’s Robocall Gap Means
Five years after the FCC began its robocall crackdown, just 42 percent of U.S. phone companies have fully installed STIR/SHAKEN, according to a U.S. PIRG analysis of FCC records. The shortfall leaves gaps in call authentication, while scammers continue to exploit caller-ID spoofing and consumers still answer unfamiliar calls.
The figures describe companies, not phone calls, subscribers, or the share of Americans protected. That distinction matters. A small provider and a nationwide carrier each count as one company in the simple percentage, even though their networks may handle vastly different volumes of calls. The reported 42 percent is a warning about implementation, not a precise estimate of the number of fraudulent calls reaching people.
The underlying problem is still plain enough. Authentication works only when providers put it in place across the relevant parts of their networks and pass the information onward. If one link fails, a caller-ID label can remain easy to fake. Frankly, a deadline without consistent enforcement is not much of a deterrent.
What Is STIR/SHAKEN?
STIR/SHAKEN is a system for authenticating caller-ID information on internet-protocol phone networks. The name joins two technical standards: STIR means Secure Telephone Identity Revisited, and SHAKEN means Signature-based Handling of Asserted information using toKENs. The standards let participating providers attach a digital signature to a call, helping receiving networks assess whether the caller is authorized to use the displayed number.
Think of it as a tamper-evident label, not a character reference. A signed call can carry information about how confidently the originating provider knows the caller is entitled to use that number. The signature may help identify a mismatch or assist with tracing a call through providers. It does not certify that the person calling is honest, that a sales pitch is accurate, or that a request for money is safe.
The Federal Communications Commission adopted caller-authentication requirements as part of a broader policy response to illegal robocalls. In 2021, then acting chairwoman Jessica Rosenworcel described the technology as a way to turbo-charge the agency’s anti-robocall tools. The compliance deadline cited in the reporting was December 31, 2023. The FCC’s caller authentication information explains the agency’s role and the technology’s place in the rules.
There are technical limits. STIR/SHAKEN was built for calls that travel over internet-protocol networks, while parts of the U.S. phone system still rely on older infrastructure. Providers may need to update equipment, coordinate with other carriers, and handle calls that cross between IP and non-IP networks. The rules and compliance paths can therefore differ with a provider’s network and circumstances; a percentage of companies marked as fully installed is not, by itself, a complete legal audit of every carrier.
That caveat does not make the reported shortfall trivial. A call can pass through several networks before reaching a phone, and authentication information is useful only when systems preserve and interpret it. I’ve analyzed enough technology mandates to be wary of counting a rule’s announcement as a result. The test is whether the safeguard works across the chain.
Core Details: The Compliance Gap and Its Consequences
U.S. PIRG says its analysis of FCC records found that 4,853 of 11,467 phone companies had fully installed the technology—about 42 percent. The analysis puts the rate at 45 percent in 2025 and says compliance has never reached half of listed companies. That is a decline in the reported share, not proof that exactly three percentage points more calls are now exposed.
The denominator needs care. A provider count treats each company equally, but companies differ in size, network design, customer base, and call volume. A large carrier that has not completed installation may carry far more traffic than a small firm—or less, depending on the case. The analysis, as described, does not provide a traffic-weighted figure showing what portion of calls receives authentication. So the simple percentage is useful for tracking provider adoption, but it cannot answer every consumer question.
PIRG’s Teresa Murray, director of its Consumer Watchdog program and author of the report, offered several possible reasons for incomplete installation. Some companies may still have old copper-wire systems; others may simply have failed to finish the work. She also argued that, in some cases, providers do not appear to care. Those are different explanations, and each calls for a different remedy: practical transition plans for legacy equipment, and credible penalties where a carrier is avoiding its obligations.
The FCC has taken enforcement steps. The reported account says the commission prohibited 1,400 phone companies from connecting to U.S. phone networks last year, with 14 more blocked in September. The year for that September action is not reported. Nor do the figures, by themselves, show how many blocked providers were blocked specifically for STIR/SHAKEN failures rather than other problems with required robocall mitigation records or compliance.
That distinction matters. A block can remove a route used by unlawful calls, but enforcement counts should not be mistaken for proof that the entire system is clean. PIRG has called FCC enforcement of the authentication rule inconsistent and urged the agency to take stronger action against providers that profit from allowing illegal calls across their networks. The regulator’s challenge is to act firmly while identifying the responsible carrier and giving compliant providers a workable path through technical changes.
The stakes go beyond an irritating phone ringing at dinner. Scammers use spoofed numbers to pose as banks, hospitals, police departments, utilities, or government agencies. A convincing caller ID can pressure someone to share account details, send money, or disclose personal information. The Federal Trade Commission’s robocall guidance warns consumers about unwanted and fraudulent calls, while the FCC’s guidance on spoofing explains how caller ID can be falsified.
Public behavior compounds the problem. In an AARP survey cited in the reporting, 21 percent of adults said they answer calls from unfamiliar numbers at least half the time; 10 percent said they respond to unknown texts at that rate. Those figures do not mean every respondent falls for a scam. They do show why an authentic-looking call or text can still create an opening for fraud. People answer for good reasons: a doctor, school, employer, or delivery driver may be calling from a number they do not recognize.
Some automated calls are useful and expected. Appointment reminders, prescription notices, and school-closure alerts can serve a legitimate purpose when people have agreed to receive them. The policy problem is not automation itself; it is unlawful or deceptive traffic, including calls designed to trick the recipient or evade consent rules. Consumer protection and useful communication are not opposing goals.
Timeline: How the Rule Reached This Point
- 2021 — The FCC promotes a stronger response. The agency announced an effort to strengthen its fight against illegal robocalls, with caller authentication among its tools. Then acting chairwoman Jessica Rosenworcel said the technology could turbo-charge the agency’s work. The policy promise was clear; providers still had to install and operate the systems.
- December 31, 2023 — The stated compliance deadline arrives. The deadline put pressure on providers to implement the required technology, subject to the rules that apply to their networks and any relevant exceptions or transition arrangements. I would not treat a missed deadline and a complete picture of legal liability as the same thing; those details depend on the provider and the applicable FCC requirements.
- 2025 — The reported share sits at 45 percent. The PIRG analysis compares its latest figure with a 45 percent compliance rate in 2025. The comparison suggests a retreat in the share of companies counted as fully installed. The analysis says the rate has never crossed 50 percent.
- 2026 — PIRG reports 42 percent fully installed. Its review of FCC records counts 4,853 compliant companies out of 11,467. That arithmetic is roughly 42.3 percent, rounded to 42. The figures measure recorded company status, not the proportion of calls that is authenticated.
- Enforcement and a request for stronger rules continue. The reported figures include 1,400 providers barred from connecting to U.S. networks last year and another 14 blocked in September; the year of that September action is not reported. Separately, New York Attorney General Letitia James and a bipartisan coalition of 49 other attorneys general sent the FCC a letter this summer urging stronger robocall rules. Their concern, as described in the reporting, is that calls and texts that are not properly screened can more easily reach consumers.
The timeline shows a familiar gap between a technical standard and consistent deployment. Announcing a mandate can set expectations, but it does not update aging switches, settle every network handoff, or ensure that a provider faces consequences for delay. The hard work happens after the headline.
STIR/SHAKEN Compared With Call-Blocking Apps
STIR/SHAKEN and call-blocking tools address related problems from different positions. Caller authentication adds information about a call as it moves between phone companies. A blocking or screening service evaluates calls on the receiving side and may use suspected spam patterns, user reports, or other signals to label or reject them. Neither tool can reliably eliminate every scam on its own.
| Feature | STIR/SHAKEN | Call-blocking and screening tools |
|---|
| Main role | Adds authentication information to calls carried on supported networks | Labels, filters, or blocks suspected unwanted calls on a device or network |
| Where it operates | Primarily across participating providers and IP-based call networks | Commonly at the carrier, device, or app level |
| What it can tell you | Whether the displayed number has a degree of provider-backed authentication | Whether a call resembles known spam or matches a filtering rule |
| What it cannot prove | That a caller’s purpose is honest or that an offer is legitimate | That every blocked call is fraudulent or every allowed call is safe |
| Reported adoption figure | 4,853 of 11,467 companies fully installed, according to PIRG | No comparable adoption percentage is reported in the figures discussed here |
| Best use | Improve caller-ID integrity and support network-level action | Reduce the number of unwanted calls that reach a person |
These tools are complements, not substitutes. A screening app may block calls before the phone rings, but it cannot make an unauthenticated network authenticate its calls. A signed call may carry useful evidence, but a legitimate number can still be used by a bad actor, and a fraudulent caller can try other channels. A combination of network authentication, careful filtering, enforcement, and consumer caution is more realistic than expecting a single fix.
The table also exposes a common measurement problem. We have a provider-compliance figure for STIR/SHAKEN in the reported analysis, but no equivalent adoption number for screening apps in the same data. Comparing those rates would be false precision. The useful comparison is about function and limits, not a made-up contest over which tool has won.
Common Misconceptions: What the Numbers Do—and Don’t—Show
Misconception: 42 percent compliance means 58 percent of calls are unauthenticated. Not necessarily. The figure counts companies, not calls. A small carrier and a national provider both count as one company, and the analysis described does not weight each one by the volume of traffic it carries. It is fair to say implementation is incomplete across the provider list; it is not fair to convert that directly into a percentage of calls or people left unprotected.
Misconception: Authentication proves a caller is legitimate. It does not. STIR/SHAKEN is intended to help verify the relationship between a caller and the number shown on caller ID. It cannot tell whether someone is making a truthful claim, whether a bank really needs your password, or whether a demand for immediate payment is genuine. A verified number is a stronger clue about number use, not a certificate of good intentions.
Misconception: Every automated call is illegal. Many are not. A reminder from a medical office or a notice about a school closing may be expected and useful. The issue is unlawful or deceptive calls and texts, including scams that use spoofing to imitate trusted institutions. The FCC’s consumer guidance on unwanted robocalls and texts sets out ways to report and reduce unwanted contact.
Misconception: The FCC has done nothing. The reported blocks show that the commission has taken action against some providers. The tougher question is whether the scale and consistency of enforcement are enough to deter companies that carry illegal traffic. A large number of exclusions can signal active enforcement, but it does not prove that every responsible provider has been identified or every route closed.
Misconception: Consumers can solve this by ignoring every unknown number. That advice is tidy and often impractical. People may be waiting for a call from a clinic, school, job, or public agency. They can let unknown calls go to voicemail when possible, avoid sharing sensitive information in response to an unexpected call, and contact an organization using a number from its official website or a statement. But the burden should not rest entirely on the person holding the phone. Providers and regulators control much of the infrastructure that allows spoofed calls to spread.
The deeper policy issue is accountability. A network carries more than packets and billing records; it connects people to work, health care, family, and public services. Protecting that system is a matter of stewardship and the common good, not merely a customer-service feature. When companies profit from carrying calls, regulators should expect them to take reasonable steps to prevent their networks from becoming tools for fraud.
Frequently Asked Questions
What does STIR/SHAKEN do?
It adds digitally signed information to calls on supported networks to help receiving providers assess whether the displayed caller ID is authorized. It can make spoofing harder and support call tracing, but it does not verify the caller’s honesty or the truth of a claim.
How many phone companies have fully installed STIR/SHAKEN?
U.S. PIRG’s analysis of FCC records reports 4,853 of 11,467 companies, or about 42 percent. The analysis says the share was 45 percent in 2025 and had never reached 50 percent. Those are company counts, not a measure of calls or subscribers.
Does a verified caller ID mean a call is safe?
No. Authentication can help establish whether a caller is authorized to use the number displayed, but it does not establish the caller’s intent. Do not disclose passwords, payment details, or one-time security codes just because a call appears to come from a familiar number.
What should I do about a suspicious robocall or text?
Do not follow urgent payment instructions or share personal information in response to an unexpected message. Hang up and contact the organization through an independently verified number; use your phone provider’s blocking and reporting tools, and consult the FCC or FTC guidance on unwanted calls and texts.
Final Thought
The 42 percent figure is a blunt measure, but it points to a practical failure: a national anti-spoofing policy remains unevenly installed years after the stated deadline. It does not prove that most calls are fraudulent, and it does not tell us exactly how many calls lack authentication. It does show that the government’s records, as analyzed by PIRG, contain a substantial number of providers not counted as fully compliant.
The next step should be more than another announcement. The FCC needs clear, public reporting that separates company status from call volume, explains which providers qualify for different implementation paths, and shows what happened after enforcement actions. That would let consumers and lawmakers distinguish a genuinely difficult network transition from a company simply failing to do the work. The agency should also make the consequences predictable: providers that make a good-faith transition should know the rules, while providers that repeatedly enable illegal traffic should face meaningful scrutiny.
Consumers can reduce some risk by treating unexpected requests for money or sensitive information with skepticism, even when caller ID looks familiar. That is prudent, but it is not a substitute for competent oversight. The responsibility is shared unevenly: people can pause before responding, while carriers and regulators have the greater power to make spoofing harder at scale.
A phone network should be trustworthy enough for a person to answer a call without being forced to guess whether a hospital, utility, or scammer is on the other end. STIR/SHAKEN cannot guarantee that trust. It can help build the conditions for it—if providers install it, preserve its signals, and answer to rules that are enforced consistently. The technology exists. The remaining question is whether accountability will catch up.
FAQPage JSON-LD