Smishing & 2FA Interception Defense: STIR/SHAKEN Caller ID Attestation & Out-of-Band Push Tokens
Combating SMS social engineering: telecom STIR/SHAKEN cryptographic certificates, RCS verified sender badges, and replacing SMS OTPs with FIDO2 passkeys.
Short Message Service (SMS) was engineered in the early 1980s as a secondary administrative signaling channel for GSM mobile networks. It possesses no native cryptographic authentication, no digital signatures, and zero origin-verification controls. Over the past decade, cybercriminal syndicates have industrialized smishing (SMS phishing) into an omni-channel assault vector. By leveraging commercial Application-to-Person (A2P) SMS aggregators, bulletproof VoIP providers, and rogue SMPP gateways, attackers spoof trusted financial brand names, transmit weaponized phishing links, and execute real-time man-in-the-middle 2FA interception campaigns. Neutralizing this epidemic requires deploying regulatory cryptographic call attestation (STIR/SHAKEN), adopting carrier-grade Rich Communication Services (RCS) verification, and phasing out SMS-based identity tokens.
The severity of smishing attacks stems from their psychological efficacy. While enterprise email gateways filter out spam using SPF, DKIM, and DMARC verification, mobile text messaging apps lack equivalent decentralized filtering protocols. Furthermore, SMS open rates hover above 95%, with victims instinctively trusting incoming messages purporting to be from shipping couriers, banks, or corporate IT helpdesks. To combat smishing, the telecommunications and cybersecurity industries are orchestrating a coordinated defense across carrier network firewalls, cryptographic identity frameworks, and next-generation passkey authentication.
The STIR/SHAKEN Cryptographic Architecture
To eliminate caller ID and sender identity spoofing across telecommunications networks, the FCC mandated the deployment of the STIR/SHAKEN framework (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs):
| Attestation Level | Originating Carrier Verification | Cryptographic Certificate Check | User Handset Display State |
|---|---|---|---|
| Full Attestation (Level A) | Carrier knows customer identity and verifies customer is authorized to use the exact calling number. | Digitally signed PASSporT token generated using carrier's STI-CA authorized private key. | Displays green "Caller Verified" badge with verified business logo. |
| Partial Attestation (Level B) | Carrier knows customer identity but cannot verify customer ownership of the specific outgoing number (e.g., enterprise PBX). | Signed token confirms authenticated call origination, but lacks number ownership validation. | Standard incoming caller ID without verified checkmark. |
| Gateway Attestation (Level C) | Call originated from international gateway or unauthenticated wholesale partner; zero identity knowledge. | Token certifies only the point of gateway entry into the domestic telephone network. | Flagged as "Spam Risk", "Suspected Scam", or blocked at carrier edge. |
The Mechanics of a SIP PASSporT Token
Under STIR/SHAKEN, when an originating telephone switch initiates a call, it wraps the signaling headers in a cryptographic JSON Web Token (JWT) termed a PASSporT (Personal Assertion Token), inserted directly into the SIP Identity header:
The terminating carrier verifies the ECDSA P-256 digital signature against the authorized Certificate Authority (STI-CA). If an offshore fraudster attempts to spoof an enterprise number without holding the private signing key, the signature check fails, and the carrier blocks the call before ringing the victim's device.
Transitioning to Rich Communication Services (RCS) Verified Sender Profiles
While STIR/SHAKEN hardens voice calls, text messaging is transitioning from legacy SMS to Rich Communication Services (RCS) governed by the GSMA Universal Profile. RCS introduces enterprise identity verification natively to text messaging:
- Cryptographic Brand Verification: Legitimate enterprises register their sender identity through verified aggregators. Messages display the company's verified high-resolution logo, brand colors, and an unforgeable verified checkmark.
- End-to-End Encryption (E2EE): RCS chats between modern Android (Google Messages) and iOS (iOS 18+) handsets utilize the Signal Protocol for 1-to-1 conversations, eliminating plaintext carrier interception.
- Domain-Verified Action Buttons: Interactive links inside RCS messages must match the verified corporate domain name registered with the carrier. If a smishing campaign attempts to embed a rogue domain, the carrier firewall intercepts and drops the packet.
Replacing SMS OTPs with Phishing-Resistant FIDO2 Passkeys
Regardless of carrier-side spam filters, the ultimate strategic solution to smishing and 2FA interception is completely abandoning SMS OTPs in favor of FIDO2 / WebAuthn passkeys:
Why Passkeys Mathematically Defeat Smishing Phishing Sites
- Cryptographic Origin Binding: When an employee clicks a smishing link and lands on a fraudulent portal (e.g.,
https://auth-company-login.cominstead of https://company.com), the web browser automatically enforces strict origin checking. - No Shared Secrets Transmitted: During authentication, the mobile device's Secure Enclave signs a cryptographic challenge using its private key. The private key never leaves the device.
- Zero Human Copy-Paste Vector: Because passkeys do not generate 6-digit codes, there is no code for the user to read, copy, or paste into an attacker's phishing proxy (such as Evilginx). The attack fails instantly.
Carrier A2P 10DLC Vetting & Automated Telecom Spam Filtering
In addition to consumer-facing authentication improvements, major telecommunications carriers enforce Application-to-Person 10-Digit Long Code (A2P 10DLC) registration frameworks. Administered through The Campaign Registry (TCR), A2P 10DLC requires all commercial messaging campaigns to undergo rigorous vetting before sending bulk SMS traffic:
- Brand Identity Verification (EIN & Corporate Vetting): Businesses must register their legal Employer Identification Number (EIN), corporate physical address, and authorized contact officers. Unregistered long codes face immediate throttling or total network blocking.
- Trust Score Assignment & Throughput Caps: Third-party vetting agencies calculate an algorithmic Trust Score based on corporate longevity and regulatory compliance. High-scoring enterprises receive high throughput (up to 4,500 messages per minute), while low-scoring or unverified brands are restricted to minimal rates.
- Real-Time Heuristic Content Filters: Carrier gateway firewalls utilize machine learning classifiers to inspect SMS message bodies in real time, detecting phishing keywords (e.g., 'urgent account suspension', 'crypto wallet compromised'), newly registered lookalike domains, and unapproved link shorteners, dropping malicious smishing waves before they reach subscriber towers.
Frequently Asked Questions
Does STIR/SHAKEN completely eliminate all SMS spam?
No. STIR/SHAKEN was primarily designed for voice call SIP signaling. While 10DLC (10-Digit Long Code) registration and A2P carrier vetting rules apply similar identity verification principles to commercial text messaging, scammers frequently bypass rules by purchasing cheap burner prepaid SIMs or utilizing international messaging gateways that do not enforce US regulations.
How does an adversary intercept my SMS two-factor authentication codes?
Adversaries intercept SMS OTPs through three primary methods: (1) Reverse-proxy phishing kits (like Evilginx) where the victim voluntarily types the OTP into a spoofed website; (2) SIM-swap fraud where the attacker ports the victim's number to their own device; or (3) Exploiting legacy SS7/Diameter signaling flaws on international telecom transit networks to redirect SMS routing.
Why are authenticator push notifications safer than SMS text messages?
Push notifications (like those in Microsoft Authenticator or Duo) are delivered over encrypted TLS internet connections directly to a specific enrolled device application, completely bypassing the cellular signaling network. When combined with 'Number Matching' (requiring the user to enter a number shown on the login screen), push notifications prevent push-bombing and MFA fatigue attacks.
Mobile Threat Intelligence & Defensive Architecture Review Board
Our engineering team audits cellular baseband processors, zero-trust endpoint attestation, SIM authentication protocols, and mobile malware telemetry.
Securing Enterprise Mobile Endpoints?
Implement zero-trust device health attestation, hardware KeyStore verification, and M-EDR defenses.