STIR/SHAKEN (S/S) will not help much for years. This is because bad actors are constantly looking for the path of least resistance. One concern with S/S is Time Division Multiplex (TDM) holes as the interconnection between rural telecom operators and local exchange carrier networks remains TDM/SS7. These connections are anticipated to convert to VoIP/SIP for potentially many years. The implication is that calls originated from rural operators that are authenticated (STIR) will be ineffectual in terms of validation (SHAKEN) as the S/S token will be lost prior to reaching terminating carrier.
In this article, we cover:
This will cause calls that are otherwise B-attested or A-attested to be received as unsigned. Rather than block all unsigned traffic or provide call labeling or a challenge (such as IVR), calls within this scenario will likely not receive special call treatment. This is ostensibly because nobody wants to impede normal (lawful) calls from rural network providers. Bad actors recognize this and therefore will exploit spoofing of rural network operators’ numbers.
In addition, the problem goes beyond S/S implementation issues such as TDM holes in networks. The problem lies in a broken Know Your Customer (KYC) process. The sad reality is that many call originators or traffic aggregators do not have a robust KYC. Some have problematic business procedures, such as leasing telephone numbers to entities that are not fully vetted – the owner has no idea what the leaser is doing with the telephone numbers.
However, they all too often provide B or even A-level attestation for calls from these telephone numbers. Even worse, many of the bad actors utilize the so-called snowshoe practice, which makes it prohibitively difficult for most analytics engines that rely upon event-based analytics to distinguish between SMBs and bad actors. YouMail Protective Services does not have this limitation as it engages in content-based analytics. YM PS captures the actual payload (audio) of the bad actor campaigns, allowing for definitive identification.
Communications service providers need to identify unlawful calls, avoid FCC cease & desist letters, and put an end to the risk of becoming defunct due to noncompliance or poor management, so now is the time to take the next step by downloading our free white paper on Know Your Customer and Behaviors, and the relationship between wanted and unwanted robocalls, legal versus illegal call spoofing, and solutions for identifying spoofed and/or unwanted robocalls.