- An A-level attestation tells every downstream provider that the signer knows the caller and the caller's right to use the number. The FCC cites data that 48 percent of illegal calls are A-attested.
- In a bank-industry analysis of 12,900 calls spoofing 47 large brands, more than half received A- or B-level attestation.
- The FCC proposes to codify the A, B, and C levels, to rule out a customer's own certification as the basis for A-level, and to prohibit willful mis-attestation and paying for attestation.
- The precedent is set: a provider that signed AI deepfake robocalls at A-level, relying on its customer's certification, agreed to a $1,000,000 penalty.
What an attestation promises
Under STIR/SHAKEN, the provider that originates a call signs it with one of three attestation levels, defined in the industry standard the FCC applies:
| Level | What the signing provider is saying |
|---|---|
| A (Full) | We originated the call, we have a direct authenticated relationship with the customer and can identify them, and we have verified their right to use this number. |
| B (Partial) | We originated the call and know the customer, but we have not verified their association with the number. |
| C (Gateway) | We have no relationship with whoever initiated the call, for example an international gateway. |
Downstream providers, analytics engines, and increasingly consumers’ phones rely on that statement to decide whether a call is trustworthy. An A-level attestation is only as good as the evidence behind it.
The problem the FCC is describing
In FCC 26-32, released May 21, 2026, the Commission cites data that “48 percent of illegal calls are A-attested,” and an American Bankers Association analysis of 12,900 calls that illegally spoofed numbers belonging to 47 large banks, retailers, and healthcare providers, in which more than half of the calls received an A-level or B-level attestation.
Industry data published since then points the same way. In its 2026 half-year robocall report, the call-analytics provider TNS found that STIR/SHAKEN has driven real progress among leading carriers but that authentication alone is not enough: 17% of the calls it confirmed as spoofed still carried an A-level attestation. TNS’s 2026 annual report estimates that up to 15% of spam-tagged calls were linked to SIM farms, banks of SIM cards that place calls through mobile networks and receive the attestation of the mobile carrier.
When attestation is wrong, the signer pays. In January 2024, Lingo Telecom signed AI deepfake election robocalls at A-level, relying on its customer’s certification that it had verified the numbers. Lingo agreed to a $1,000,000 civil penalty and a compliance plan with enhanced Know Your Customer measures. FCC 26-32 describes customer self-certification as “essentially the mechanism that Lingo Telecom used.”
What the FCC proposes
FCC 26-32 is a further notice of proposed rulemaking; comments closed September 8, 2026. It proposes to:
- Codify the A, B, and C levels in the FCC’s own rules.
- Tie A-level to know-your-customer compliance: the “direct authenticated relationship” would require meeting any KYC or KYUP requirements, covered in our analysis of the KYC and KYUP proposals.
- Rule out self-certification: a customer’s general statement or certification would not establish a verified association with the number.
- Prohibit willful mis-attestation, higher or lower than the facts allow, and prohibit pay-for-attestation.
- Make resellers decide: every provider that serves end users directly would make the attestation decision for its customers’ calls.
- Stop avoiding authentication: prohibit intentionally routing calls over networks that cannot carry STIR/SHAKEN when an IP route is available. The FCC cites data showing the share of signed calls falling from 49% in October 2024 to 38% in September 2025.
Status. These are proposals. A separate 2025 proposal on caller ID authentication over non-IP networks (FCC 25-25) is also pending. Already in force since September 18, 2025: rules on third-party signing, under which the provider with the STIR/SHAKEN obligation must make all attestation decisions itself and sign with its own certificate.
Questions to answer now
Provider leaders should be able to answer the following with confidence:
| # | Question for your leadership team | When |
|---|---|---|
| 1 | For each customer whose calls we sign at A-level, what evidence shows its right to use those numbers? | Now |
| 2 | Do any of our A-level decisions rest on a customer’s own certification? | Now |
| 3 | Are our STIR/SHAKEN token and certificates current, and are third-party signers using them as the rules require? | This quarter |
| 4 | If our signed calls appeared in a traceback, could we justify the attestation level on each one? | This quarter |
Answering these questions takes evidence behind every signature. The VoiceAlerts Compliance Team can review where you stand in a free 30-minute briefing.
Key dates
| Date | Milestone |
|---|---|
| Aug 21, 2024 | Lingo Telecom agrees to a $1,000,000 penalty over A-level attestation of deepfake robocalls. |
| Apr 29, 2025 | FCC proposes caller ID authentication on non-IP networks (FCC 25-25). |
| Sep 18, 2025 | Third-party signing rules take effect (FCC 24-120). |
| May 21, 2026 | FCC proposes stricter attestation and KYUP rules (FCC 26-32). |
| Sep 8, 2026 | Reply comments close on FCC 26-32. |
How VoiceAlerts helps
VoiceAlerts keeps STIR/SHAKEN tokens healthy, verifies the customers and upstream providers behind the calls you sign (KYC and KYUP), and keeps the evidence that supports every attestation decision.
- Attestation decisions and the evidence behind them
- STIR/SHAKEN token and certificate health
- Customer and upstream vetting that supports A-level signing
Common questions
What do STIR/SHAKEN attestation levels A, B, and C mean?
Under the industry standard the FCC applies, A (full) means the signing provider originated the call, has a direct authenticated relationship with the customer, and has a verified association with the number. B (partial) meets the first two but not the number association. C (gateway) means the signer has no relationship with the call's initiator.
How often do illegal calls carry A-level attestation?
FCC 26-32 cites data that 48 percent of illegal calls are A-attested, and a bank-industry analysis of 12,900 calls spoofing 47 large banks, retailers, and healthcare providers in which more than half received A- or B-level attestation.
What does the FCC propose to change about attestation?
FCC 26-32 proposes to codify the three levels, to require that the direct-relationship criterion be met through KYC or KYUP compliance, to rule out a customer's general certification as a basis for number association, and to prohibit willful mis-attestation and pay-for-attestation. It is a proposal.
How can VoiceAlerts help providers with attestation?
VoiceAlerts keeps STIR/SHAKEN tokens healthy, verifies the customers and upstream providers behind signed calls, and keeps the evidence that supports each attestation decision.
Sources
- docs.fcc.govFCC 26-32: Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN, Further Notice of Proposed RulemakingReleased May 21, 2026
- docs.fcc.govFCC Enforcement Bureau: Lingo Telecom, LLC, Order and Consent Decree (DA 24-790)August 21, 2024
- docs.fcc.govFCC 24-120: Call Authentication Trust Anchor, Eighth Report and Order (third-party signing)Effective September 18, 2025
- tnsi.comTNS: 2026 Half-Year Robocall Investigation Report17% of confirmed spoofed calls A-attested
- tnsi.comTNS: 2026 Robocall Investigation Report, Going Further Than STIR/SHAKENSpam-tagged calls linked to SIM farms
- docs.fcc.govFCC 25-25: Call Authentication Trust Anchor, Notice of Proposed Rulemaking (non-IP caller ID authentication)Released April 29, 2025
This article is for general information and is not legal advice. Proposed rules can change before adoption; check the FCC record for the final text.
