Phone & Caller ID Spoofing Prevention for Banks: FAQs on STIR/SHAKEN, Deepfakes & FFIEC Compliance

Phone spoofing (caller ID spoofing) is when a caller falsifies the number – and sometimes the name – shown on the recipient’s caller ID to hide their identity or impersonate a trusted organization. Banks are prime targets because a call that appears to come from “your bank” carries instant trust, which fraudsters weaponize to extract credentials, one-time passcodes, and payments.

Spoofing runs in two directions, and banks must address both: inbound, where a fraudster spoofs a customer’s number to slip past the contact center’s caller-ID trust, and outbound, where a fraudster spoofs the bank’s number to reach customers directly. The phone remained the second most common fraud contact method in 2024, and it produced the highest median loss per victim (FTC, 2024).

Caller ID spoofing prevention is the set of controls that verify whether the number shown on a call is genuine and whether the caller is who they claim to be. For a bank it is layered: network-level call authentication (STIR/SHAKEN), inbound spoof/ANI risk scoring, branded and verified outbound calling, and – for the caller’s identity rather than just the number – passive voice biometrics with deepfake detection.

No single control is sufficient, because each solves a different part of the problem. STIR/SHAKEN attests to the calling number; ANI/spoof scoring flags suspicious inbound routing; branded calling proves an outbound call is really from the bank; and voice biometrics plus synthetic-speech detection judge whether the human on the line is genuine. The resilient pattern combines them in a risk-based decision.

A bank cannot make spoofing technically impossible, but it can make its legitimate calls verifiable and its impostors detectable. By authenticating outbound calls with STIR/SHAKEN A-level attestation and adding branded caller ID (a verified name, logo, and call reason), a bank gives carriers and customers a cryptographic basis to tell a real bank call from a spoofed one.

This is why outbound call integrity is a fraud control, not just a marketing one: a fraud-alert call that a customer ignores because it looks like spam can turn into a downstream loss. Verified, branded calls raise answer rates and shrink the window in which a spoofed “bank” call can succeed.

STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) is an industry-standard framework that lets the originating carrier digitally “sign” a call’s caller ID and downstream carriers verify that signature across IP networks. The FCC has required voice providers to implement it in the IP portions of their networks since June 30, 2021.

Enabled by the TRACED Act of 2019, STIR/SHAKEN lets the terminating carrier confirm that the caller ID number was legitimately used and label or block calls that fail verification. The critical nuance for a bank: it authenticates the number and the originating carrier – not the human caller’s identity or the content of the call. It is necessary, but not sufficient on its own. (FCC, Combating Spoofed Robocalls with Caller ID Authentication)

Attestation is the originating carrier’s statement of how much it knows about the caller’s right to use the number. There are three levels – A (full), B (partial), and C (gateway) – and they directly affect whether your outbound calls display as verified or get flagged as spam.

To get legitimate outbound calls treated as trustworthy, a bank’s traffic should consistently earn A-level attestation – which is why call-branding and verified-calling programs matter operationally, not just cosmetically. (FCC Report and Order FCC 24-120; ATIS standards)

No. STIR/SHAKEN verifies the calling number and the originating carrier – it says nothing about who is actually speaking or whether the voice is real. A fraudster using a legitimately obtained number, or a deepfake voice on an inbound call, passes through STIR/SHAKEN untouched.

This is the most important misconception for a bank to correct. Number authentication and voice authentication are different layers. Defending against synthetic voice requires passive voice biometrics combined with liveness and dedicated deepfake (synthetic-speech) detection, layered on top of – not replaced by – call authentication.

Fraudsters use generative-AI voice cloning two ways: to impersonate customers on inbound calls – defeating knowledge-based security questions in the customer’s “own” voice – and to impersonate bank executives or staff in social-engineering and authorized-push-payment scams. The U.S. Treasury’s FinCEN has formally warned banks about this trend.

In its November 2024 alert (FIN-2024-Alert004), FinCEN reported a rise in suspicious-activity reports describing GenAI deepfake media used to circumvent identity verification and authentication, and recommended multi-factor authentication (including phishing-resistant MFA) and live verification checks as mitigations. Because AI voice cloning is now cheap and fast, any control that relies on a shared secret the caller can simply recite — KBA, PINs – is especially exposed. (FinCEN, 2024)

Yes, in effect. In a Declaratory Ruling on February 8, 2024, the FCC confirmed that AI-generated and voice-cloned voices are “artificial” under the Telephone Consumer Protection Act (TCPA) – so using them to call consumers without prior express consent is unlawful, and the ruling gave state attorneys general new tools to pursue voice-cloning scams.

For a bank this cuts two ways. It is a regulatory tailwind against impostors who clone the bank’s or an executive’s voice. It also means the bank’s own use of AI voices – AI voice agents, prerecorded outreach – must meet the TCPA’s consent, caller-identification, and opt-out requirements. (FCC Declaratory Ruling FCC 24-17)

Deepfake detection analyzes live call audio for artifacts of synthetic generation – spectral irregularities, unnatural cadence, and replay/playback signatures – and pairs that with liveness detection and a voiceprint comparison. Treated as one signal in a risk-based decision alongside spoof scoring and behavioral analysis, it flags a cloned caller that a security question or PIN never could.

Technically, three things work together: passive voice biometrics builds and matches a voiceprint (“something you are”); a synthetic-speech classifier scores the probability the audio is machine-generated; and liveness confirms a live speaker rather than a recording. FinCEN similarly points banks toward dedicated detection software and metadata analysis, used within a layered program rather than as a single gate.

The FFIEC’s 2021 authentication guidance states that single-factor authentication is inadequate for high-risk users and transactions and directs banks toward layered security and multi-factor authentication, noting that reliable identity verification “generally do[es] not depend solely on knowledge-based questions.” NIST SP 800-63B has withdrawn knowledge-based authentication (security questions) as an acceptable authenticator outright.

Read together, the standards push banks in one direction for the phone channel: retire KBA as a primary control, stop treating any single memorized secret as sufficient for sensitive calls, and move to layered, risk-based authentication in which network-level call authentication and a biometric voice factor do the heavy lifting. Examiners increasingly expect the contact center to meet the same bar as digital banking. (FFIEC 2021 / OCC Bulletin 2021-36; NIST SP 800-63B)