Our commitment to combating spam

The telecommunications industry will soon be implementing regulatory changes which Bipath is committed to supporting as part of a global effort to combat fraudulent spam calls and text messages. The two changes, the Application to Person messaging service, also known as A2P 10DLC, and STIR/SHAKEN, will require businesses to obtain an attestation trust score by creating a business profile. The trust score provides the underlying carrier with information to verify that the communications are not spam.

Across 2021, businesses will be assigned a trust score for outbound calling, which will be “signed” by the underlying originating caller’s carrier and sent to service providers or mobile networks like AT&T, T-Mobile (including Sprint) and US Cellular. There will be different ratings, or attestations, of calls: A, B or C. These ratings allow carriers to verify information about the call or text message and give consumers a better idea of the validity of the caller. “A” rated calls are likely to be treated favorably, while “B” and “C” rated calls will be viewed as more suspicious. Over time, the weight given to attestation ratings is expected to increase according to some carriers.

Read on for more information on what you can expect from these changes, what will be required, and how your business can maintain compliance.
What to expect
  • STIR/SHAKEN: Start the registration process within the Contact Cloud app
  • STIR/SHAKEN takes effect June 30, 2021
  • A2P/10DLC: Start the registration process within the Contact Cloud app
  • A2P/10DLC Campaign registry takes affect May 1, 2021
Checklist
Follow these steps to ensure your business is compliant and to earn trust with customers and prospects.

Business profile registration FAQ’s

What are the requirements for business registration?

Private Companies, Charities and Non-Profits
- Business Name
- Physical Address (Street, City, State/Province/Region, Postal Code, Country)
- Business Identity (Direct Customer or ISV/Reseller/Partner)
- Business Type (Sole Proprietorship/Partnership/Corporation /CoOperative/LLC/Non-Profit)
- Company Status (Private/Public)
- Business Registration Number & Type (DUNS or Business License)
- Industry
- Website URL
- Regions of Operations
- Point of Contact/Authorized Representative for your Business

Private Companies, Charities and Non-Profits
- All of the above
- Stock Ticker & Exchange

How do these changes affect me?

These regulatory changes are industry wide so businesses will need to register their phone numbers for the business profile to obtain a trust score for both STIR/SHAKEN and A2P. For A2P messaging, there are additional steps that are needed to register your Brand and campaign/use case (additional fees will apply) which the carriers will need to approve. Campaign approval can take up to 48 hours to 78 hours. As soon as additional information is released from the carriers we will post updates here.

Why are the carriers making these changes?

With these industry changes, part of the process is to implement an attestation trust score so the underlying carrier can verify the calls and SMS outbound traffic from companies is not spam, robocalls, or fraudulent.

How long does it take to get an Attestation Trust Score?

Normally the Attestation Trust Scores will be delivered within 48 to 78 hours.

What dependencies reflect my Attestation Trust Score provided by the carrier?

Business attestation scoring is based on Business Type, longevity, address, Tax ID or DUNS number. Note: the longer a company is in business and once registered the score could go up according to the carriers.

Are there costs involved with registering my account to obtain a Trust Score?

No fee is involved for initial registration of your business profile.

Can I challenge the Attestation Trust Score?

Yes, by paying a fee to a 3rd party verification provider they can do an independent check and provide you a Trust Score. The fee normally runs anywhere from $40.00 to $55.00.

Once I’ve been provided an attestation trust score is there anything else I need to do?

Yes, You will need to register the phone number for both STIR/SHAKEN and if you are using A2P messaging you will need to add your Brand, campaign type, and a sample message which will be submitted to the carrier for approval.

If I am an agency, will I need to register all of my sub accounts individually?

The new regulation for A2P and STIR/SHAKEN will require you submit this information for each business or sub account within your Contact Cloud account. Bipath is working to streamline this process for our agency customers and will share additional information as it becomes available.

Stir/Shaken FAQ’s

Where does the term SHAKEN come from?

SHAKEN is an acronym standing for Signature-based Handling of Asserted information using toKENs. SHAKEN is a software based verification process designed to significantly reduce robocalls as well as ensuring caller ID displays are valid protecting consumers. The FCC’s recent report states that unwanted calls are their number one consumer complaint. Caller ID spoofing leads to fraud.

Did an industry group create SHAKEN?

Yes, SHAKEN was created by the task force IP-NNI working for ATIS-SIP Forum. IP-NNI stands for “Internet Protocol – Network to Network Interface”. The Internet Engineering Task Force (IETF) formed the working group STIR (Secure Telephone Identity Revisited) to develop policies for carriers. STIR in turn created SHAKEN which is why it is typically referred to as STIR/SHAKEN.

How does SHAKEN work?

Based on a business profile created by the company there are multiple factors that drive an attestation trust score. Trust scores are derived from the longevity of the business, tax ID or DUNS number, physical address, and verified company contacts. Based on the attestation trust score, calls that are being initiated by a company and delivered to the carrier’s consumer phone, validation will be provided in the following (e.g. Spam, Scam Likely, or “valid company name” ).

When does STIR/SHAKEN go into effect?

Beginning June 30, 2021 STIR-SHAKEN initiative will be implemented by United States telecommunications providers. This will enhance consumer confidence and trust when accepting calls.

What will my caller ID look like when STIR/SHAKEN is implemented on my phone?

That will depend on your provider, and telephone manufacturer as to what caller ID display will show (e.g. Spam, Scam Likely, or “valid company name” ).

Will STIR/SHAKEN cost me additional fees?

At this time, Bipath is not aware of any additional fees to consumers. However, the industry is still defining guidelines. Agencies may incur fees when challenging their attestation trust score.

Is STIR/SHAKEN a United States only regulatory initiative? Will Canada be affected?

STIR/SHAKEN is a US based initiative. However, Canada will most likely follow suit.

What will happen to calls that receive low attestation scores?

At this time carriers are still defining rules and attestation criteria. There is no clear plan for calls with low attestation scores. However, it is possible that low attestation scored calls will not be delivered. As information becomes available we will post updates here.

How does a business maintain a high attestation score?

Once an attestation trust score is established, over time businesses will gain additional credibility and their attestation score should increase with the carriers. However, low answers rates and short call duration calls (Under 60 seconds) could contribute to lowering a company’s attestation trust score causing calls not to be delivered.

If I make a STIR/SHAKEN-signed call that potentially is a robocall will the underlying carrier deliver the call?

Yes, if you have established a high attestation trust score the call should be delivered. The higher the attestation score, the more likely the call will be delivered to the end user. Should a company’s attestation score drop, they will most likely see a decline in call delivery.

A2P/10DLC FAQ's

How does A2P 10DLC work?

The requirements needed for the A2P 10DLC service are as follows:

- Business profile creation/registration is the first step needed to identify who they are in order to send messages to the carrier networks.

- Businesses will then need to register their Brand and the campaign type and provide a sample message (or two) that they are sending to their customers e.g. campaign types, marketing messages, account notifications, delivery notifications, etc.

- Registration will need to be completed using the Campaign Registry registration page for all types of messages being sent.

What is the timeline for registration and deadlines for A2P 10DLC registration?

At this time, no information has been confirmed by the carriers regarding an official timeline. We will share additional information and deadlines as they become available.

What happens if I don't register?

We encourage customers that are currently sending messages to complete the registration process with the Campaign Registry so your messages are delivered. Carriers will begin assessing pass through surcharges for unregistered traffic for SMS and MMS (see the fees links here). Carriers also intend to increase their filtering for non-registered SMS and MMS, to protect their customers from unwanted messages or SPAM. Once Bipath gets further information regarding this we will update this document accordingly.

So what does a Trust Score truly mean and how is it determined?

Once you complete the registration process at https://www.campaignregistry.com/ and register your campaigns. The Campaign Registry (TCR) will use a reputation algorithm to review specific information about your company, and will assign a “Trust Score” that will determine your messaging throughput rate.

Why does the Trust Score determine my throughput rate?

Since Trust Scores have three different levels (Low, Medium, to High) the score will be used along with your Campaign type to determine the total throughput rate for the Campaign type you wish to send.

What is a Campaign?

A series of use cases make up a campaign type. Each use case represents the type of notification you would like to provide. So for example, if you would like to run a marketing campaign for coupon advertisements, that would fall under a marketing use case, or you wanted to send out appointment reminders to your customer, that would fall under the category of Reminders, A list of detail use cases are provided below. One note: each campaign (or Use Case) type needs to be registered separately.

Do I need to select a Use Case when registering a campaign?

Yes, the use case determines the type of message being sent and determines the carrier passthrough fee that will be charged for each message deliver to a mobile network operator (MNO) i.e. ATT Wireless, Verizon Wireless, Tmobile etc. Use cases vary from reminders, 2 factor authentication, marketing messages, customer notifications, to public service announcements, and many more. A list is provided below for the Use Cases.

With these changes will I need to register my campaign in the The Campaign Registry?

At this time, yes you would be required to register your business and campaign with TCR as a separate process. Bipath is in the process of integrating our technology with TCR to make the process smoother and easier. Since this is so very new, and policies are still evolving, that integration has not yet been completed.

If I would like to register for the A2P 10 DLC brand, what is needed?

In order to register your business profile, brands, and campaigns, you will need to have information about each business and brand. The required information may include the business name, physical address, business type, Industry type, Tax ID or DUNS number, and provide 1 company contact under your business profile.

What about MMS messaging are they affected by A2P 10DLC change?

Yes, it is recommended that if you are using high-volume MMS campaigns, then leveraging a short code is still the best option.

Are dedicated Short codes or Toll Free Numbers affected by these changes?

These changes do not directly affect dedicated short codes along with Toll-Free numbers.

Will I need new phone numbers to use this A2P 10DLC service?

No, if you already are using 10 digit phone numbers for sending messages there is no need to buy new numbers. However, you will need to register the existing phone numbers for each campaign type to ensure your message will be delivered.

Campaign registration fees

Campaign Type
Cost
Charity
$5/month
Low-volume mixed-use
$2/month
All other types
$10/month
* The threshold for "low volume" has not yet been defined by carriers. This article will be updated when that information is available.

Mobile Network Operator
Network Access Fees

Carrier
Link to fee table
AT&T
Verizon
Tmobile
Sprint

Use cases

Use Case
Campaign Type
Additional Vetting Required?
Decription
2FA
Declared
No
Any authentication or account verification such as OTP
Account Notifications
Declared
No
Notifications about the status of an account or related to being a part of an account

Customer Care
Declared
No
Support, account management, and other avenues of customer interaction
Delivery Notifications
Declared
No
Information about the status of a delivery
Fraud Alert Messaging
Messaging about potential fraudulent activity such as spending alerts
Declared
Message campaigns from colleges, universities, and other education institutions
Higher Education
No
A campaign that covers multiple use cases such as marketing promotions and delivery notifications. Primarily for small businesses. Note - mixed campaigns are likely to have lower throughput and a higher cost per message.
Declared
Low Volume Mixed
Promotional content such as sales and limited time offers
A campaign that covers multiple use cases such as Customer Care and Delivery Notifications. Note - mixed campaigns are likely to have lower throughput and a higher cost per message.
No
Marketing
Mixed/Marketing
Notifications about polling and voting
PSAs to raise audience awareness about a given topic
Mixed
Notification of a compromised system (software or hardware related)
Mixed/Marketing
No
Polling and voting
Carrier-exempted campaigns
Messages from a registered charity such as 501c3 charities. Note - religious organizations are not included
Mixed/Marketing
Public Service Announcement
In-app peer-to-peer (P2P) conversations using proxied or pooled numbers or personalized services for enterprise or A2P communications to protect privacy of personal numbers
No
Notifications about/supporting public safety during emergency situations
Security Alert
Declared
Sweepstakes related communications
Messages from a verified campaign to influence decision making
Carrier Exemptions
No
Declared
Non-commercial communication within or between closed communities
Charity
No
No
Declared
Conversational Messages
No
Yes
Yes
Emergency
Special
Yes
Yes
Sweepstakes
Yes
Special
Yes
Political
Yes
Declared
Special
Social
Special
Declared
Declared