Why your contact centre calls are being flagged as spam — and how to fix it

If your outbound calls are showing up as "Spam Likely," "Scam Risk," or "Potential Fraud" on recipients' phones, you are not alone — and you are probably not doing anything wrong. Around 25 to 30 percent of legitimate business numbers are incorrectly tagged by carrier analytics engines at any given time. For a contact centre making thousands of calls a day, that translates directly into missed connections, wasted agent time, and lost revenue.

Understanding why it happens — and what actually fixes it — requires looking at two separate systems that most operators conflate: STIR/SHAKEN call authentication, and carrier analytics-based spam labelling. They are related but distinct, and fixing one without addressing the other will not solve your problem.

The two systems involved

STIR/SHAKEN is a cryptographic framework mandated by the FCC that allows carriers to verify whether a call is genuinely coming from the number it claims. When your calls leave your platform, your carrier signs them with a digital certificate at one of three attestation levels — A, B, or C — depending on what the carrier can verify about your identity and your right to use the calling number. That signed token travels with the call through the network.

Carrier analytics is a separate layer operated by third-party companies — primarily Hiya (used by AT&T), TNS (used by Verizon), and First Orion (used by T-Mobile). These companies analyse calling behaviour patterns and assign reputation scores to phone numbers. A number that makes a high volume of short-duration calls, generates consumer complaints, or shows unusual dialling patterns will be flagged regardless of its STIR/SHAKEN attestation level. A fully authenticated call can still be labelled as spam if the behaviour behind it looks suspicious to the analytics engine.

This is the critical point that most guides miss: getting A-level STIR/SHAKEN attestation is necessary but not sufficient. You need both clean authentication and clean calling behaviour.

Why attestation level matters

A-level attestation — full attestation — means your carrier has verified both your identity and your right to use the calling number. It carries the strongest signal of legitimacy and is the hardest to obtain. B-level means the carrier can verify your identity but cannot confirm your right to use the specific number displayed, which is common with ported numbers or numbers managed through intermediaries. C-level means the carrier can only confirm the call entered their network from a gateway — it cannot verify the caller at all.

B and C level calls are not automatically blocked, but they have a much lower threshold for triggering spam labels from analytics engines. A high-volume contact centre running on B-level attestation is operating with a significant structural disadvantage. Every spike in call volume, every batch of unanswered calls, every consumer complaint moves it closer to a spam flag than an equivalent operation running on A-level attestation.

The reason many contact centres end up with B-level attestation is their infrastructure setup. Cloud-based dialler platforms, reseller VoIP arrangements, and bring-your-own-carrier integrations often break the direct relationship between the business and the number at the carrier level — which is exactly what A-level attestation requires. If your platform is signing calls using a shared certificate rather than one tied directly to your business, you will not achieve A-level.

What triggers spam flags from analytics engines

Carrier analytics engines do not publish their exact criteria, but the patterns that consistently trigger flags are well understood from operational experience:

Call volume per number. Making more than approximately 50 to 75 calls per day from a single number is a common trigger. This threshold varies by carrier and analytics engine, but the principle is consistent: volume concentration on a single number looks like robocalling behaviour. Contact centres running high outbound volumes should distribute calls across a sufficient pool of numbers to keep per-number daily volume within safe ranges.

Short call duration. A high proportion of calls with average durations under 15 to 30 seconds — calls that ring out, are immediately rejected, or connect briefly and disconnect — closely resembles the profile of illegal robocall operations. Predictive dialers that dial ahead of agent availability create dead-air calls that have exactly this profile. The FCC as of March 2026 also now requires carriers to return a specific SIP response code (603+) when blocking calls as "Network Blocked," which means contact centres can now identify when calls are being blocked at the network level rather than simply going unanswered.

Consumer complaints. When recipients report a number as spam — through their phone's built-in reporting, through apps like YouMail, or directly to carriers — that signal is fed back into the analytics engines. A small number of complaints on a high-volume operation may not trigger a flag immediately, but sustained complaint rates will. This is why calling practices matter as much as technical setup: harassing calls, repeated calls to the same number, and calls outside business hours all generate complaints that degrade number reputation.

Rapid number cycling. Replacing flagged numbers with new ones quickly is a well-known scammer tactic, and analytics engines are trained to recognise it. New numbers that immediately begin generating high outbound volume are suspicious by definition. If your operation routinely burns through numbers, the pattern itself will attract attention.

How to fix it

Check your current attestation level. Ask your voice provider what attestation level your calls are being signed at, and request to see sample SIP headers confirming it. A provider that cannot or will not tell you this is a problem. If you are on B or C level, understand why — it is usually a question of how your numbers are provisioned and verified at the carrier level.

Register your numbers. AT&T, Verizon, and T-Mobile have jointly created the Free Caller Registry, a single portal where you can register your business information and phone numbers. Submitting verified business details to this registry shares them with all three carriers' analytics partners simultaneously. Registration does not guarantee your calls will never be flagged, but it gives the analytics engines verified context about your operation, which materially reduces flagging risk. It is free and takes one submission to cover all three.

Review your dialling behaviour. Look at your per-number daily call volumes, your average call duration, your answer seizure ratio, and your abandoned call rate. If any of these are in ranges that resemble robocall patterns, adjust before addressing the analytics engine flags — because fixing the reputation score without fixing the underlying behaviour will not hold.

Submit label removal requests. If specific numbers are already flagged, each carrier has a process for submitting a label removal request. You will need to identify which carrier is serving the affected recipients, provide documentation of your legitimate business use, and submit through the carrier's portal. Response times vary but carriers are generally responsive to well-documented requests from legitimate operations. The new SIP 603+ transparency requirement means you can now identify network-blocked calls from your CDR data rather than guessing.

Review your upstream carrier relationship. If your calls are signed at B or C level, the fix is usually at the infrastructure layer — specifically, ensuring that the numbers you are using are provisioned and verified under your business identity at the carrier level, not managed through an intermediary that breaks the verification chain. This is a conversation to have with your wholesale voice provider.

For offshore contact centres calling AU, US, and UK numbers

International calls — calls that originate offshore and terminate to numbers in Australia, the US, or the UK — carry particular challenges. Calls entering from foreign networks typically receive C-level attestation by definition, since the gateway provider processing the international handoff cannot verify the original caller. This means offshore contact centres calling Australian, US, or UK numbers are structurally disadvantaged from an attestation perspective.

The mitigation is local number presence: using Australian, US, or UK DIDs as the presented calling number, with the actual call traffic originating from your offshore infrastructure but presenting a local number via your wholesale voice provider. This does not change the gateway attestation level, but it changes how the call appears to the recipient and to analytics engines — a local number calling a local number is treated differently to an international number calling a local number.

The legal requirement is that you have a genuine right to use the number being presented. Using a local DID provisioned through a licensed carrier in that jurisdiction — properly allocated to your operation — satisfies that requirement. Using a spoofed or borrowed number does not.