Fix STIR/SHAKEN Calls in 30–90 Days, U.S. Ecommerce Teams

U.S. ecommerce teams: diagnose STIR/SHAKEN attestation, fix carrier and number hygiene, then pilot Orphora AI. Use the 30–90 day checklist to restore A...

Specialist reviewing a verified call trace

Before you rewrite scripts or add agents, verify that your outbound numbers carry A-level attestation and that your carrier enforces do-not-originate rules. Confirm your provider owns its own SPC token, fix number rotation and dialing pace, then pilot an AI voice agent like Orphora AI to absorb peak-hour volume. The FCC’s call authentication framework rewards this order of operations, and skipping the diagnostic step wastes money on everything after it.

TL;DR:

  • Ensuring outbound numbers carry A-level attestation and have proper carrier ownership of SPC tokens is critical to improve answer rates and reduce false flags.
  • Calls with B or C attestation levels are more likely to be blocked or flagged, especially during high-volume periods or with lower-quality carriers, impacting delivery alerts and customer trust.
  • Regularly verifying and demanding written confirmation of attestation levels, SPC token ownership, and carrier compliance can prevent ongoing issues and ensure consistent trust signals.
  • Improving call reputation through behavioral habits like number rotation and volume pacing is essential, as carrier analytics score based on calling patterns beyond attestation.
  • Automation alleviates staffing worries but cannot fix attestation or carrier compliance issues; the most effective strategy combines proper setup with AI-driven responses during peak periods.
Orphora AI
Handle Customer Calls Around the Clock
Orphora AI voice agents help WooCommerce businesses answer inquiries instantly using real-time order and customer data.

Table of Contents

What Does STIR/SHAKEN Mean for Business Calls?

STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted Information Using Tokens) form the FCC’s framework for digitally signing and verifying caller ID on calls carried over IP networks. Every call gets tagged with an attestation level: A, B, or C.

A-attestation means the carrier authenticated the caller, verified they have the right to use that number, and can confirm the call’s origin. B-attestation means the carrier verified the customer but not that specific number. C-attestation means neither could be confirmed, often because the call passed through a gateway or an unknown upstream network.

This matters because a signed call is not automatically a trusted call. Attestation only tells receiving carriers how confident the originating network is in the caller’s identity. A B or C label still reaches the destination, but it reaches it flagged. The FCC’s rules apply to providers on IP networks, and CFR §64.6305 layers on a separate obligation: providers must run robocall mitigation programs and file certifications regardless of their attestation practices. Compliance and answer rates are related, but they are not the same problem, and treating them as one is where most e-commerce operations teams go wrong first.

Why Attestation and Reputation Determine Whether Customers Pick Up

An order confirmation call that never gets answered is not a customer service failure. It is often a signaling failure that happened before your agent ever dialed.

Think about the calls e-commerce businesses actually place: delivery window alerts, payment verification, return authorization, fraud checks on high-value orders. Every one of these depends on the customer trusting the number on their screen enough to answer it. When a carrier labels a call “Spam Likely” or shows no verified checkmark, answer rates drop, and that drop lands squarely on operations. Delivery alerts go unheard, return windows lapse because the customer never picked up, and support tickets pile up from people who ignored three calls and then complained they weren’t notified.

Industry data backs the size of this problem. Amdify’s carrier guidance found that B-level attestation can reduce answer rates compared to A-level by a noticeable margin, and C-level traffic is frequently blocked outright or buried under aggressive filtering. For a store running thousands of order-related calls a month, that gap is the difference between a smooth fulfillment cycle and a support queue full of “why didn’t you tell me” tickets.

How to Check Your Attestation Level and Fix It With Carriers

You don’t need a telecom engineering degree to find your attestation level. You need a SIP trace and a short list of pointed questions.

Run a trace first. Ask your telephony provider or SIP trunk vendor for a call trace on a recent outbound call and look at the Identity header. The attest field will show A, B, or C directly. Most VoIP platforms and SBCs (session border controllers) can produce this on request, and providers who resist giving you this basic diagnostic are themselves a warning sign.

Once you have a baseline, take these steps in order:

  1. Ask your carrier which attestation level applies to each DID you use for outbound calling, not a blanket company-wide answer.
  2. Confirm whether they’re facilities-based or a reseller. Facilities-based carriers that own network infrastructure can typically deliver A-attestation more reliably than resellers routing through third parties.
  3. Ask who holds the SPC (SHAKEN provider certificate) token. Under the 2025 Federal Register order, providers with STIR/SHAKEN obligations must hold their own certificate and sign calls themselves, with only limited third-party signing allowed.
  4. Check the Robocall Mitigation Database for your carrier’s filing. If they’re not listed or the filing looks stale, that’s grounds to escalate or switch.
  5. If you land on B or C, demand written confirmation of the attestation level and a remediation timeline, or move your DIDs to a facilities-based provider that can commit to A-level.

Pro Tip: Keep call trace logs from before and after any carrier change. If answer rates don’t improve within two weeks, you have documented proof to dispute billing or escalate to a new provider.

Operational Habits That Keep Legitimate Calls From Getting Flagged

Attestation is the technical layer. Reputation is the behavioral layer, and carriers weigh both when deciding whether to let a call through clean.

Terminating carriers run their own analytics on top of STIR/SHAKEN signatures, scoring numbers based on calling patterns, complaint volume, and how long a number has been active. A brand-new DID make 500 calls in an hour looks like a robocall operation even with perfect A-attestation.

A few habits make a measurable difference:

  • Rotate through a pool of verified DIDs instead of hammering one number, and retire any number that’s been flagged or complained about.
  • Pace outbound volume so it doesn’t spike suddenly, especially during sale events or shipping delays when call volume naturally surges.
  • Keep call durations realistic. A pattern of many sub-five-second calls (people hanging up instantly) reads as spam behavior to carrier analytics.
  • Log every complaint or blocked-call report and open a support ticket with your carrier immediately, with the trace data attached.
  • Enforce do-not-originate (DNO) status on numbers that should only receive inbound calls, since spoolers frequently target unused or inbound-only DIDs.

Sangoma’s operator guidance confirms that calling patterns and number reputation influence labeling independently of attestation, meaning a fully signed A-level number can still get flagged if the dialing behavior looks abusive.

Where AI Voice Agents Fit Into a Fixed Call Infrastructure

Once your attestation and carrier setup are sound, the next bottleneck is usually staffing during peak call windows. This is where automation earns its place, not as a replacement for compliance work, but as a way to handle volume once the underlying signal is clean.

Orphora AI runs voice agents built specifically for WooCommerce stores, answering calls around the clock and pulling real-time order and customer data to resolve status checks, return questions, and shipping inquiries without a human agent picking up the phone.

A practical rollout looks like this:

  • Confirm your telephony provider’s attestation level before routing calls through any automation layer.
  • Connect the voice agent to WooCommerce so it can pull live order and customer records.
  • Run a pilot during a known peak window (a sale event, a holiday shipping surge) and measure results against a baseline week.
  • Track response time, deflection rate, and customer satisfaction scores before and after.

Pro Tip: Pilot automation on your highest-volume, lowest-complexity call type first, like order status checks. That’s where deflection has the fastest payoff and the least risk of frustrating customers with a bad experience.

Automation solves a capacity problem. It does not fix a B-attestation trunk or an unenforced DNO policy, and treating it as a substitute for that work just moves the same answer-rate problem downstream.

A 30 to 90 Day Priority Checklist

Run these roughly in order, since each step makes the next one more effective:

  1. Days 1 to 15: Pull SIP traces on your active DIDs and document current attestation levels across every carrier relationship.
  2. Days 15 to 30: Get written confirmation from carriers on SPC token ownership, DNO enforcement, and Robocall Mitigation Database status. Escalate or switch where answers are vague.
  3. Days 30 to 60: Fix number hygiene: retire flagged DIDs, build a rotation pool, and set volume pacing limits.
  4. Days 60 to 90: Stand up reputation monitoring, log every complaint, and pilot an AI voice agent for one high-volume call type to measure impact on answer rates and support backlog.

Why Calls Still Drop or Get Rejected After You Fix Attestation

Getting to A-attestation doesn’t guarantee zero problems. A few failure patterns show up repeatedly once teams think they’ve solved the issue.

False rejections on legitimate calls usually trace back to one of three causes: a certificate mismatch where the signing certificate doesn’t match the calling party’s registered identity, a gateway or PBX that strips SIP headers before the call reaches the carrier, or an intermediate carrier in the call path that doesn’t pass attestation data through cleanly. If your calls look correctly signed on your end but arrive unattested on the receiving end, the break is almost always in a middle hop you don’t control directly.

Call drops after implementing STIR/SHAKEN often stem from SBC misconfiguration, where the session border controller isn’t properly passing the Identity header, or from a mismatch between your SIP trunk provider’s signing practices and your PBX’s expected header format. Start troubleshooting by pulling traces from both ends of a failed call, not just your own.

Intermittent labeling where some calls from the same number get flagged and others don’t usually points to inconsistent routing across multiple underlying carriers, which happens more than businesses expect when a provider load-balances traffic across several upstream networks with different attestation practices.

The fix in nearly every case is the same: get a trace, identify exactly where the header breaks or the attestation degrades, and push that specific evidence back to whichever carrier owns that leg of the call.

Troubleshooting flow for failed attestation

Training Your Team to Build Trust on Verified Calls

Fixing the technical side only pays off if your customers actually pick up and your staff know how to handle what happens next.

Start by telling customers what to expect. A short line in your order confirmation email, “We may call you from [number] to confirm delivery details,” does more to lift answer rates than any technical fix alone. Pair that with consistent caller ID branding across every outbound number so customers see the same business name every time, not a rotating cast of unfamiliar digits.

Train agents to open calls by immediately stating the business name and the reason for the call within the first five seconds. Customers who’ve been burned by robocalls are primed to hang up, and a slow, generic opening gives them every reason to. Scripts that front-load specificity, referencing the actual order number or delivery date, signal legitimacy faster than a generic greeting.

For inbound support, make sure agents know how to explain STIR/SHAKEN status if a customer asks why a call showed up as unverified or spam-labeled. A simple, honest answer, “That’s a carrier labeling issue on our end that we’re actively fixing,” builds more trust than deflecting the question. Track which agents or scripts correlate with higher answer and completion rates, and feed that back into training. Small wording changes in the first ten seconds of a call often move the needle more than people expect.

Training Your Team to Build Trust on Verified Calls — overview diagram

What to Track to Know If Your Fixes Are Working

You need a small set of numbers you check weekly, not a dashboard full of vanity metrics.

Answer rate by attestation level is the core metric. Segment your call data by A, B, and C attestation and watch whether the gap closes as you move numbers to better carriers. Call completion rate measures how many answered calls result in a full conversation rather than an immediate hang-up, which flags trust problems even when someone does pick up.

Complaint and block rate, tracked through carrier tickets and any direct customer feedback, tells you whether your reputation is improving or degrading. Number-level answer rate trends matter too. A single DID with a sudden answer-rate drop is often the first sign it’s been flagged, well before you’d notice from aggregate data.

On the automation side, track response time, deflection rate (the percentage of calls resolved without a human agent), and customer satisfaction scores separately from your attestation metrics, since these measure a different layer of the system entirely. Review all of these together monthly. A rising deflection rate paired with a falling answer rate means your automation is working but your carrier setup is quietly getting worse, and that combination is easy to miss if you only look at one metric at a time.

Staying Ahead of Evolving FCC Requirements

STIR/SHAKEN obligations aren’t static, and the 2025 Federal Register order tightened rules around third-party signing arrangements specifically because providers were outsourcing certificate ownership in ways regulators considered risky.

Build a recurring compliance calendar rather than treating this as a one-time project. Quarterly, confirm your carrier’s Robocall Mitigation Database filing is current and check that they still hold their own SPC token rather than relying on a third-party signer, since the 2025 order narrowed how much of that work can be outsourced. Annually, review your entire DID inventory against attestation levels and retire or renegotiate any numbers stuck on B or C.

Assign accountability internally, even if it’s a single operations lead responsible for the carrier relationship. Regulatory changes tend to arrive as amendments to existing rules rather than entirely new frameworks, so a team that already understands its current attestation and DNO posture adapts faster than one starting from zero each time a new order lands. Keep a simple log of every carrier conversation and commitment in writing. When enforcement tightens, documented due diligence is what separates a business that gets a warning from one that gets penalized.

Handling Mixed Attestation Levels Across Multiple Carriers

Most mid-size e-commerce operations don’t run on a single carrier. They use one provider for transactional SMS, another for voice, maybe a third for a call center platform, and each can have different attestation practices.

The fix starts with an inventory, not a technology purchase. List every DID, which carrier handles it, and what attestation level it gets. Route your highest-priority calls, delivery confirmations, fraud alerts, time-sensitive returns, exclusively through whichever carrier delivers consistent A-attestation, even if that means paying more per minute for that traffic.

For lower-priority outbound calls where B-attestation is unavoidable given vendor constraints, compensate operationally: warm up new numbers gradually, keep volume low per DID, and monitor complaint rates closely since these numbers are more vulnerable to flagging. When a call center vendor or third-party dialer is involved, confirm in writing whether they sign calls themselves or pass signing responsibility to you, since the 2025 signing rules make that distinction a compliance question, not just a technical one. Multi-vendor setups work fine as long as you know which vendor owns which attestation outcome and you route accordingly instead of assuming uniform treatment across the board.

Orphora AI’s Take on Balancing Compliance With Automation

Too many teams treat automation and carrier compliance as separate projects run by separate people, and that split is exactly why fixes stall. Attestation and DNO enforcement solve trust at the network level. Voice automation solves capacity at the operational level. Neither replaces the other, and businesses that deploy AI voice agents on top of an unfixed B-attestation trunk are automating a problem instead of solving it. Fix the signal first, then scale the response.

— Orphora AI

Get Started With Orphora AI Voice Agents

Once your carrier setup is clean, the next constraint is usually staffing during your busiest call windows. That’s the gap Orphora AI closes for WooCommerce stores.

Orphora AI

Some AI voice agents answer around the clock, pulling real-time order and customer data to handle status checks, returns, and shipping questions without a live agent on the line. Orphora AI reports an 85% faster response time and a 95% customer satisfaction rate among stores running its agents, figures the company attributes to eliminating the wait time customers face with traditional phone queues. The feature set covers order lookup, return handling, and direct WooCommerce integration, so the agent works from the same data your support team already sees.

If your attestation and number hygiene are already in shape, the next step is a straightforward pilot. Visit Orphora AI’s installation page to see what connecting a WooCommerce store looks like, and run it against one high-volume call type first to measure the impact before rolling it out further.

Sources

FAQ

What Is STIR/SHAKEN and Why Does It Affect My Business Calls?

STIR/SHAKEN is the FCC’s framework for digitally signing caller ID on IP-network calls, and it assigns each call an attestation level (A, B, or C) that carriers use to decide how much to trust it, which directly affects whether your calls get answered or flagged.

How Do I Find Out My Current Attestation Level?

Run a SIP trace on an outbound call through your telephony provider or SBC and check the Identity header’s attest field, which will show A, B, or C.

Can a Fully Signed Call Still Get Blocked or Flagged?

Yes. Terminating carriers layer their own analytics on top of attestation, scoring calls on complaint history, calling patterns, and number age, so a signed A-level number can still get flagged if the dialing behavior looks abusive.

Does Adding an AI Voice Agent Fix Attestation Problems?

No. Automation like Orphora AI solves call-capacity and response-time problems, but it doesn’t change your carrier’s attestation level or your Robocall Mitigation Database status, which require separate carrier-level fixes.

What Should I Ask My Carrier If I’m Stuck on B-Attestation?

Ask whether they’re facilities-based or a reseller, who holds the SPC token, and request written confirmation of your attestation level per DID along with a remediation timeline.