STIR/SHAKEN and the TRACED Act: What Small Business VoIP Buyers Need to Know

The TRACED Act and the mandate behind STIR/SHAKEN

The Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, known as the TRACED Act, was signed into law in December 2019. Among many provisions, it directed the FCC to require voice service providers to implement STIR/SHAKEN call authentication. Reference: FCC summary of the TRACED Act.

The FCC implementation timeline required large carriers to implement STIR/SHAKEN by June 2021, with smaller carriers given extensions through 2023 and 2024. As of mid-2026 essentially all US-licensed carriers, including the VoIP providers serving SMBs, have implemented STIR/SHAKEN on their core voice traffic.

The TRACED Act also created the Robocall Mitigation Database where carriers must register their robocall mitigation programs and certify their effort to combat illegal robocalls. Carriers found non-compliant can be removed from the database, which causes downstream carriers to block their traffic. For SMB buyers the practical relevance is verifying that your VoIP provider is in good standing with the RMD.

Attestation levels A, B and C

STIR/SHAKEN issues each outbound call one of three attestation levels. A-level (full attestation) means the originating carrier has authenticated the caller and knows the number belongs to them. B-level (partial attestation) means the carrier knows the caller is one of its customers but cannot validate the specific number. C-level (gateway attestation) means the call entered through an interconnect and the carrier cannot vouch for the caller at all.

Receiving carriers use the attestation level to feed their spam-labelling algorithms. A-level calls almost always reach the receiver unmolested. B-level calls may show with a "Verified" indicator or no indicator at all. C-level calls are heavily scrutinised and often flagged as Spam Likely.

For SMB VoIP, A-level attestation is the goal. To achieve it, your provider needs verifiable proof that the numbers you are calling from belong to you. Most tier-one providers handle this at account setup by collecting your business verification documents. Verify in your VoIP admin console that your numbers show A-level attestation; if they show B or C, contact your provider's support to resolve.

Why calls get Spam Likely labelled even with A attestation

A-level attestation prevents the worst of the spam labelling but does not fully prevent it. Receiving carriers and their analytics partners (First Orion, Hiya, TNS, Truecaller) maintain their own classification layers that draw on call patterns, recipient reports and behavioural signals.

The patterns that trigger spam labelling: high call volume from a single number (300+ calls per day looks robotic), low answer rate (under 20 percent of calls answered suggests cold-call spam), short call duration (calls averaging under 30 seconds suggest hang-ups or wrong numbers), recipient reports as unwanted (a few "Block this number" actions from recipients cascade into broader spam labelling).

Mitigation patterns: maintain calling hygiene. Honor opt-out requests promptly. Pace outbound calling so you do not exceed roughly 100-150 outbound calls per number per day. Use multiple outbound numbers spread across a calling team rather than concentrating volume. For legitimate sales outreach, expect to register with First Orion and Hiya through their First Orion business registration and Hiya business pages.

Carrier-level checks before vendor selection

Before signing with a VoIP provider, verify two things. One, the provider is in good standing in the FCC's Robocall Mitigation Database. Two, the provider issues A-level attestation for customer outbound calls.

All eight providers we cover (RingCentral, 8x8, Nextiva, Dialpad, Vonage, Zoom Phone, Ooma, Grasshopper, OpenPhone, Microsoft Teams Phone) are RMD-registered and issue A-level attestation. The differences emerge in edge cases: porting in a number from a less-reputable previous carrier may inherit reputation issues that take weeks to clear. Using a phone number that has been used previously for robocalling will result in poor call connectivity until the reputation is rebuilt.

For ported-in numbers, request a fresh number check from your new provider's support team. Some providers offer reputation cleansing services; most do not. If your business depends on outbound calling, give a fresh ported number a 2-to-4-week ramp before relying on it for high-volume outreach.

Practical actions for an SMB outbound-calling team

For a sales team that depends on outbound calling, the practical compliance and reputation playbook:

• Verify A-level attestation in your VoIP admin console; resolve any B or C immediately with support.
• Register your business numbers with First Orion via their business identity portal and with Hiya through their business portal. Both are free for legitimate businesses.
• Maintain calling hygiene: pace outbound to under 150 calls per number per day; respect opt-out requests within 24 hours.
• Use multiple outbound numbers spread across a calling team rather than burning one number for all volume.
• Monitor your numbers' spam-labelling status weekly via the labelling-analytics partners' dashboards. Fix issues fast; reputation cascades.
• For ported numbers, allow a 2-to-4-week ramp before relying for high-volume outbound.

The unfortunate reality is that even with all of this in place some calls will be labelled Spam Likely. The receiving carrier algorithms are imperfect and skew toward false positives because their main job is reducing real spam. Expect 5 to 15 percent of your outbound calls to recipients on major US carriers to show some form of spam indicator regardless of compliance effort.

Frequently asked questions