Recent months have seen a drastic increase in the number of unwanted and fraudulent calls. These 'spam' calls, as they're commonly called, often come from established business numbers, phone numbers local to you, or even your own phone number. This is possible due to the increasing availability of SIP telephone server software. Session Initiation Protocol, or SIP, is an internet technology that allows for telephone calls to be made over the internet instead of using traditional phone lines.

It is very easy today for anybody to set up their own phone server and purchase calling capabilities from phone carriers. This gives these individuals the ability to not only place calls from their own computers but also allows them to turn those servers towards dishonest purposes. Because of the nature of SIP servers it is possible for the server operator to define any caller ID number that they want. For honest operators this means setting the caller ID to a number that the operator (or their customer if they're a hosted SIP provider) actually owns. However, there is currently nothing stopping a bad faith SIP operator from 'spoofing', or setting their caller ID, to the name and number of a well known bank, or the contact number for the IRS, or even your own number. This allows those bad faith operators to add another level of faux-legitimacy to their spam calls in the hopes of tricking unsuspecting people into giving out personal information or even sending money to illegal enterprises under the guise of legitimate business.

Unfortunately there isn't much we can do to stop them today. Because of the way SIP operates in tandem with the traditional plain old telephone system (or POTS) there are no checks and balances to prevent anybody from spoofing anybody else's caller ID. That's all changing, though.

The FCC has mandated that all carriers, big and small, adopt a robocall mitigation plan and foremost among those plans is a technology known as STIR/SHAKEN. This STIR/SHAKEN protocol consists of a signature that carriers will have to apply to any call they generate, and not just anybody can sign calls. You have to be approved by the FCC's STI-GA (Secure Telephone Identity Governance Authority) as a legitimate carrier to be able to sign calls. Any carrier that wants to be able to sign their own outbound calls will not be allowed to accept unsigned calls or they risk losing their ability to sign calls themselves. What this amounts to is that bad actors will no longer be able to "spin up" their own SIP server and begin making fraudulent calls. Only FCC approved carriers will be allowed to make and receive calls and they will be required to ensure their customers aren't acting in bad faith, either. All of this will in turn protect the consumer from spam calls with falsified caller ID information. This new system also provides the capability to report spam calls that may slip through the cracks and allows action to be taken against the carriers that allow these calls through.

These rules officially go into effect on September 28th of 2021, so until then we still live in the wild west of telephone calls, but help is on the way.