Caller ID Should Have to Prove Itself

Opinion & analysis

A phone should let someone call across the world. It should not let them borrow your grandson’s number as a costume. Cheap, convenient communication is worth defending. So is the expectation that the number lighting up a screen has something to do with the person calling.

In its latest older-consumer report, the FTC says adults 60 and older reported approximately $3 billion in fraud losses in 2025, up from about $600 million in 2020. Those are reported losses across fraud types and contact methods—not a phone-scam total, and certainly not an AI-scam tally. The distinction matters. The harm is large enough without creative accounting.

The phone version of email authentication already exists

If email can use DKIM, SPF and DMARC, why can’t telephone networks authenticate callers? They can. The system is called STIR/SHAKEN, and federal rules already require covered voice providers to implement it on their internet-protocol networks, subject to specified exceptions. The initial general deadline was June 30, 2021.

The email comparison is useful, with limits. DKIM adds a domain’s digital signature; SPF identifies servers authorized to send using a domain. DMARC checks alignment with the visible From domain and lets domain owners express handling preferences for failures. Passing those checks does not make an email honest.

For calls, STIR uses a cryptographic signature in call signaling. The receiving side can verify signed identity information rather than simply accepting a displayed number. SHAKEN adds full, partial and gateway attestation levels, describing different confidence levels about the call’s originating identity. They are not interchangeable seals of approval.

Encryption answers a different question: who can read or hear protected data? Secure RTP, for example, provides confidentiality protections for media. Encrypting a scammer’s audio would not make its origin authentic. Caller authentication does not certify the speaker’s voice or the truth of a request, either. A signed call can still carry a lie.

“Digital” does not mean authenticated from end to end

The weak point is the complete route. In its May 2026 proposed rulemaking, FCC 26-32, the FCC identified implementation gaps, improper attestations and routes through non-IP networks that cannot carry STIR/SHAKEN information. A modern handset does not tell you what happened at every carrier handoff.

That document proposed stronger upstream-provider checks, tighter attestation standards and restrictions on deliberately choosing routes that lose authentication information. Those are proposals in that document, not universal protections this article can promise are already operating.

There are legitimate complications. A business may display its main number for outbound calls, as the FCC itself notes. International calls, forwarding and older networks need workable treatment. The policy target should be unauthorized impersonation, not making it impossible to reach a doctor, travel abroad or maintain a small phone service.

Regulate the chain, not just the warning label

My position: the FCC should finish closing these gaps, with clear implementation deadlines and enforcement that reaches providers enabling abuse. Congress should supply any additional authority or resources needed. Another instruction for grandparents to “be careful” is not an infrastructure policy.

Require providers to substantiate their authentication claims and preserve identity information through supported routes. Make upstream accountability and cooperation with lawful traceback requests enforceable. Require measurable reporting on failures and prompt correction when legitimate calls are wrongly blocked. Test the results, not merely whether a provider bought a signing service.

Set enforceable security baselines for call signaling and media transport, including encryption where technically supported and published migration plans for legacy links. Stronger rules also need emergency safeguards, privacy protections and accessible redress. Automatically treating every unsigned call as criminal would be a blunt substitute for engineering. A verification badge should communicate what was checked, without implying that a carrier has certified the caller’s character.

A familiar voice is no longer enough

The FTC has warned that a short audio clip can help scammers clone a loved one’s voice. That warning establishes a real capability, not a count of how many calls use it. In 2024, the FCC classified AI-generated voices as artificial voices under the Telephone Consumer Protection Act, bringing them within existing restrictions. That did not outlaw every consensual or otherwise exempt use of synthetic speech.

Until network protections improve, the FTC’s practical advice remains sound: verify an urgent request by contacting the person through a number you already know, or another trusted relative or friend. Do not let the incoming number or familiar voice do the verification for you.

The industry already has a language for signed identity. Government should require it to mean something across the network. The phone can remain easy to use without making impersonation everyone else’s problem.

Original Knuxy conceptual illustration. Not an image of an actual scam or a specific phone service. Sources and regulatory documents checked November 4, 2026.