Callback & VoIP Bypass Tactics: How Scammers Evade STIR/SHAKEN and What You Can Do

Why this matters: Caller ID authentication isn't a silver bullet

STIR/SHAKEN is an industry framework that helps carriers cryptographically sign and verify Caller ID attestation so recipients (and network filters) can know whether a call likely originated from the number shown. It has reduced a large volume of spoofed calls when implemented across the call path, but it does not eliminate all fraud. Limitations in international routing, gateway handling, and the rise of automated callback farms and synthetic voices mean attackers still find practical ways to reach victims and make malicious calls appear legitimate.

This article explains the common bypass techniques used today, recent trends (including AI‑assisted voice farms and callback automation), and straightforward verification and reporting steps you can use to reduce risk for yourself, your family, and your organization.

Common VoIP and callback bypass techniques — what scammers do and why it works

The following tactics are commonly observed in research and regulatory investigations. Understanding them makes it easier to spot patterns and respond safely.

1. Gateway re‑origination, international termination and ‘OTT’ bypass

Calls often traverse multiple providers before reaching a consumer. Scammers route traffic through intermediaries or off‑net gateways so call authentication can be stripped, altered, or never applied. Regulators and enforcement programs have repeatedly targeted gateway providers because they can be the point where malicious international traffic enters a domestic network.

2. One‑ring / wangiri and flash calls (callback traps)

Short automated calls that ring once and stop (“wangiri” or one‑ring scams) or automated flash calls are designed to get you to call back. The callback rings you into a live agent or premium‑rate/foreign termination chain. These short calls are cheap at scale and effective because humans instinctively call back missed calls that look important. Research that analyzes robocall content shows many campaigns use dedicated callback numbers shared across campaigns.

3. Number leasing, ported numbers, and re‑assigned DIDs

Fraudsters can rent or lease legitimate DID (direct inward dial) numbers from providers, or use re‑assigned/abandoned numbers that retain trust. If a number was previously used by a business or government office, recipients may assume legitimacy based on the number alone. Because STIR/SHAKEN attestation depends on the calling provider’s relationship to the number, leased or poorly‑vetted number inventories can be used to give malicious calls plausible credentials.

4. AI voice farms and callback automation

Large-scale farms use text‑to‑speech, voice cloning, or automated agents to place calls and to handle callbacks. When a victim calls back, an automated system (or low‑cost call center) picks up with a scripted, convincing response. Recent academic and industry research documents both the growth of automated voice defenses and the parallel increase in AI‑assisted vishing, and experimental defenses such as ASR‑jamming have been proposed to disrupt automated scam systems.

5. Intentional routing to strip attestation

Some campaigns deliberately route calls over TDM interconnections or through networks that do not convey STIR/SHAKEN tokens, so that the call arrives without authentication metadata and may be more likely to bypass some filters. Regulatory proposals and enforcement have specifically addressed this tactic by extending obligations to gateway and intermediate providers.

Practical verification steps — a short checklist you can use now

When you or a colleague see a suspicious call, follow a simple verification routine that attackers cannot control. Below are consumer and small‑organization steps that reduce the chance of falling for callback and VoIP bypass tricks.

1. Don't call back the missed number. If you expect a legitimate call, the organization will contact you again or leave a verifiable voicemail. Calling back impulsively is one of the simplest traps.
2. Use trusted channels to verify. If the call claims to be from a bank, government agency, or service provider, hang up and call the number on the official website, on your account statement, or on the back of your card — not a number the caller gave you. This out‑of‑band verification is the recommended approach.
3. Ask for proof the caller can’t fake on the spot. For financial requests, ask for an account reference, ask them to call you back on a published support number, or request a secure message via your account portal. Avoid giving one‑time codes, passwords, or remote‑access approval codes to anyone who calls out of the blue.
4. Implement a three‑step callback verification at work. For customer‑facing staff: (1) note the incoming number and reason, (2) verify identity through internal records or a trusted official number, (3) for any financial or account changes, use a manager or second channel confirmation. This prevents social‑engineering escalation during a returned call.
5. Lock your number with your carrier and enable anti‑port protections. Ask your provider for a PIN, port freeze, or number lock and prefer authenticator apps/hardware keys over SMS for critical accounts — SIM/eSIM porting is a known takeover vector. Report suspicious porting attempts immediately.
6. Use reputation and pattern‑based call filtering. Use a network or handset spam filter (carrier‑provided or third‑party apps like YouMail/Truecaller) that blocks based on campaign patterns, not only single numbers. Campaigns rotate numbers; pattern detection is more effective than one‑off blocking.
7. Record and report. If you receive a scam or suspicious call, report it to your carrier, the FTC, and the FCC — reports feed enforcement efforts that target gateway providers and illegal campaigns. If you lost money, file an FTC complaint and contact your bank immediately.

When in doubt, pause: attackers rely on pressure and urgency. A deliberate, out‑of‑band verification step defeats most callback traps.

What regulators and carriers are doing — and what to expect next

Regulators in the U.S. and internationally have been focused on the gateway problem and on strengthening both know‑your‑upstream‑provider rules and STIR/SHAKEN enforcement. Enforcement initiatives (for example Project Point of No Entry and FCC gateway rules) have targeted gateway providers that let illegal international traffic into domestic networks, and recent proposals would force additional upstream vetting and blocking obligations. These actions aim to reduce the practical avenues scammers use to strip authentication or re‑originate calls.

At the same time, industry and academic research is producing both new attack methods (AI voice cloning, automated callback handling) and defensive technologies (improved attestation models, ASR‑disruption tools, better network filtering). Expect continued cat‑and‑mouse activity: technical defenses will improve, but attackers will keep adapting routing and automation techniques.

Quick takeaways

• STIR/SHAKEN helps, but it is not foolproof — attackers exploit routing/gateway gaps and social‑engineering.
• Never call back an unknown missed call — verify via official channels.
• Harden your mobile account (port freeze, PIN) and prefer non‑SMS 2FA for critical accounts.
• Report scams to your carrier, the FTC and FCC so enforcement can trace and shut down gateway abuses.

If you want, we can provide a printable one‑page script for staff or seniors that lists the exact verification questions and the three‑step callback protocol. Would you like that?