Behind the operating system interface lies the telecommunications industry's technical backbone: the STIR/SHAKEN protocol. Mandated across North American voice networks, the cryptographic framework aims to stamp out call spoofing risks by attaching digital certificates to calls passing through Session Initiation Protocol (SIP) interconnected trunklines.
The protocol assigns one of three attestation levels to every originated call:
Full Attestation (Class A): The service provider generated the call, knows the customer, and confirms the customer has the legal right to use the telephone number.
Partial Attestation (Class B): The provider originated the call from an authenticated customer, but cannot verify if the customer has authorization to use the specific dial string displayed on the caller ID.
Gateway Attestation (Class C): The provider received the call from an unvetted international gateway or wholesale trunk and can only verify where the transmission entered its network, offering zero assurance regarding the number itself.
A "Likely a Business" label frequently attaches to calls carrying Class B or Class C attestation that match records in commercial clearinghouses. Carriers like AT&T (ActiveArmor), Verizon (Call Filter), and T-Mobile (Scam Shield) process these signals through third-party data providers like Transaction Network Services (TNS), First Orion, and Hiya. If an analytics engine sees consistent, non-abusive commercial traffic from a registered telecom account, the carrier system clears the number of fraud flags, producing a neutral commercial tag on your screen.
