Frequently Asked Questions

STIR/SHAKEN is the call-authentication framework standardized by the IETF and ATIS and mandated by the FCC for U.S. voice networks. When a call is placed, the originating network cryptographically signs the calling number in a token called a PASSporT. The terminating network verifies that signature before the call reaches the phone.

A valid signature means the network that placed the call attested to the caller's right to use that number. A missing or invalid signature means the calling number cannot be trusted. That is the classic mark of a spoofed call.

Branded Calling ID (BCID™) is the wireless industry's standard for trusted caller identity, governed by CTIA. It builds on STIR/SHAKEN to carry cryptographically signed Rich Call Data from the originating network to the phone's screen: the verified agency name, official logo, and reason for the call.

It is the same framework major banks and hospitals use to brand their calls, applied here to police, fire, EMS, 911 centers, and other government entities.

Logo guidance: CTIA's BCID Display Preview Tool currently specifies a logo of 256 × 256 px on a solid background. The Registry preserves your highest-quality original and generates the carrier renditions for you.

Criminals impersonate police departments, courts, and 911 centers to frighten people into sending money or personal information. With STIR/SHAKEN and BCID in place:

• A spoofed call faking a registered agency number carries no authorized signature, so it fails verification and carriers can block it before the phone rings.
• The public sees the verified agency name, official seal, and reason for the call before answering. 911 callbacks, investigative calls, and court notices get answered instead of ignored.
• Every verified call is signed with security keys administered by the Public Safety Identity Authority, so the identity on screen is checked in real time against the Registry.

See How It Works for the full call flow.

Branded display works on mobile phones on the major wireless networks. Landlines still use traditional caller ID (CNAM), which carries a name only. What each phone shows depends on the device, its software version, and the carrier:

• Samsung, Motorola, and TCL phones running Android 14 or later can show the full display: verified name, seal, and call reason.
• iPhone XS and later on T-Mobile running iOS 18.5 or later show the verified name and seal.
• iPhone on Verizon requires a newer iOS release (26.5 or later) and shows the verified name and seal.
• Prepaid and smaller carriers that resell the big networks usually deliver the verified display name only.

The important part: even when a phone cannot render the seal or call reason, the verified agency name still appears. And call blocking does not depend on the display at all. A spoofed call fails signature verification and can be stopped no matter what phone the resident carries.

A few phone-side conditions can hold back the seal or call reason even when the verified name comes through:

• The carrier feature is switched off. On iPhone it is called Carrier Call Identification, under the Business Call Identification settings. On Android it is called Verified Business Call, under the phone or Enriched Calling settings. Both are usually on by default.
• A VPN is active. VPNs can block the logo download. The name still shows.
• Dual SIM. The seal is delivered to calls on the primary line only. Calls to the second SIM show the name without the image.
• Verizon data plans and devices. Verizon delivers the name only, without the seal, on some capped or metered data plans and on phones that were not purchased from Verizon. Phones bought unlocked or brought over from another carrier commonly fall in this group.
• Spam-filter labels win. If the carrier's spam-protection app has flagged a number as risky, that label takes priority over the branded display. Agencies with this problem should contact us, because it usually means the number needs reputation remediation with the carriers.
• Older devices. Phones below the versions listed above show standard caller ID.

After the Identity Authority approves your identity and submits it to the carriers, each carrier reviews and provisions it on their own schedule. Plan on 24 to 72 hours for full propagation. Once a number is live, the branded display can take a couple of additional hours to start appearing on handsets.

Changes work the same way in reverse: when a number is removed or revoked, carriers can take a day or two to fully clear the old display from their systems.

The Coosada 911 Communications District, a public body organized under the laws of the State of Alabama, is the verification and onboarding authority for this program. Before anything is submitted to the telephone carriers, the District reviews each agency's credentials, telephone numbers, official name, and logo.

The Public Safety Identity Authority (PSIA), operated by the District, issues and administers the cryptographic signing keys, approves what appears on phones, and enforces program rules, including revocation when necessary.

Enrollment is limited to governmental and public-safety entities: 911 centers and communications districts, law enforcement, fire and EMS, emergency management, courts, public health, schools, utilities, and other federal, state, tribal, county, city, and special-district government organizations. Private public-safety providers such as private EMS may enroll only when operating under a governmental contract.

This registry is not for private commercial use. Businesses that want branded calling should work with a commercial BCID partner through CTIA's program.

Ready to apply? See Agency Enrollment. Not sure yet? Book a free call with a specialist.

When PSAP A transfers or forwards a call to PSAP B, or to any other government entity, the original caller's authenticated identity must travel with the call. RFC 8946 defines the PASSporT div (diverted) extension for exactly this: the diverting center adds its own signed attestation of the redirect without replacing the original caller's signed number.

Done correctly, the receiving center sees the original caller's number and the full signed chain of custody: who called, and who diverted the call along the way.

If diversion signing and identity passthrough are missing, the receiving PSAP sees the transferring center's trunk number, an unsigned call, or a rewritten caller ID instead of the original caller. That breaks CAD lookups, call recording attribution, callback to the original caller, and any BCID branding on the leg.

The transfer still "works" as audio, which is exactly why this gap so often goes unnoticed until a callback fails or records are needed.

This is an industry-wide problem. Many NG911, ESInet, and SIP providers do not enable RFC 8946 diversion PASSporTs or original-identity passthrough by default, including some well-established 911 network providers. It is a configuration gap worth verifying with your own provider.

A correctly configured transfer path preserves the original caller's identity end to end:

• SIP Identity headers are preserved across the transfer, not stripped.
• A div PASSporT is added on each legitimate divert, per RFC 8946.
• The original ANI remains available to the receiving PSAP for CAD, records, and callback.
• The caller ID is never silently rewritten to the transferring center's published number, unless the center is intentionally placing a new outbound call rather than diverting the existing one.

The Coosada 911 Communications District is in the business of providing managed services to other government and public-safety entities:

• Program administration end to end. Enrollment, credential vetting, registry hosting, signing-key administration, carrier submission, and revocation.
• Security and support. Configuration review, PSAP transfer-path testing, documentation, and ongoing operational support.
• Training. Helping agency staff understand verified calling, transfers, and what the public sees.

Agencies receive verified calling without building or operating any of the infrastructure themselves.

Yes. If your current carrier or NG911 vendor cannot originate calls with proper STIR/SHAKEN attestation, or cannot sign Rich Call Data for BCID, the Coosada 911 Communications District provides outbound SIP service with cryptographic signing. Callbacks and official outbound calls leave the network fully attested, so they verify and display correctly on the receiving end.

Book a call with a specialist or contact your PSIA representative to discuss outbound SIP.

A .gov domain is the clearest public signal that your website and email genuinely belong to a U.S. government entity. CISA administers the .gov program at get.gov, and registration is free for eligible governments, no matter how small your agency is.

It also speeds up your enrollment here: when your verified administrator email is on a .gov or .mil domain that matches your agency's stated domain, enrollment qualifies for the fast path with no waiting.

Size does not excuse weak practice. Whether you are a two-seat PSAP or a state agency, the expectation is the same:

• Follow CISA and DHS guidance for state, local, tribal, and territorial governments, including the CISA Cybersecurity Performance Goals and CISA's 911/PSAP cybersecurity resources.
• Basic hygiene: multi-factor authentication, least-privilege access, patching of known exploited vulnerabilities, logging, and incident reporting.
• Written security policies. A small agency's policy can be short, but it must exist.

During enrollment you will be asked whether your agency adheres to CISA and DHS advisories. Answering "no" or "unsure" does not disqualify you. A registry security specialist will contact you to review your posture before approval.

Operational readiness is more than technology:

• Training. Staff should understand verified calling, transfer procedures, and how to respond when verification fails.
• Documentation. Written transfer procedures, change control, and after-action notes.
• Testing. Periodic STIR/SHAKEN and RFC 8946 test calls with neighboring PSAPs, so a broken transfer path is found in a drill rather than an emergency.
• Insurance. Cyber liability and public-entity coverage appropriate to 911 and telecommunications operations, reviewed as part of your agency's due diligence.