Caller ID spoofing, STIR/SHAKEN, and how to actually block calls in Canada

Why Canada’s call authentication system does not block a single call, what it does instead, and which blocking measures genuinely help.

Last reviewed 2026-07-26. Written for readers in Canada.

Caller ID was never designed as a security feature. The number your handset displays is supplied by the calling party’s equipment, and for most of the telephone network’s history nothing checked whether the caller was entitled to use it. That is spoofing: not a hack, just an unverified field being filled in dishonestly.

STIR/SHAKEN authenticates. It does not block.

This is the most important thing to understand about call protection in Canada, and it is the opposite of what most people assume.

STIR/SHAKEN — Secure Telephone Identity Revisited, and Signature-based Handling of Asserted information using toKENs — was mandated by the CRTC in Decision 2021-123 and took effect on 30 November 2021. Under it, your carrier checks whether a caller is entitled to the number they are presenting, digitally signs an attestation saying how confident it is, and sends that signature along with the call. The receiving carrier verifies the signature. Carriers can only sign if they hold a token from the Canadian Secure Token Governance Authority.

What happens next is where expectations break. Nothing is blocked. The framework produces a verdict, not an action. Bell states the position plainly in its own customer documentation: STIR/SHAKEN does not block any calls, and it does not give Bell or any other carrier authority to block a call based on its attestation level. Compatible handsets may display a verification indicator. That is the whole of the consumer-facing effect.

The attestation itself is also narrower than it sounds. Full attestation means the carrier knows the customer and confirms they are entitled to that number. Partial attestation means it knows the customer but cannot vouch for the number. Gateway attestation means it only knows where the call entered its network — which is typically what an international call gets. A signed call is not a trustworthy call; it is a call whose origin someone is prepared to vouch for at some level.

The coverage gaps nobody mentions

The CRTC applied the obligation to IP-based voice calls only. Where a carrier’s network still carries traffic over older TDM switching, those calls fall outside the framework. Canada also implemented a lighter version than the United States, and in practice calls that are redirected, forwarded, or routed through certain toll-free arrangements may not carry usable attestation end to end.

So the scam call that concerns you most — an international operation, routed through intermediaries, spoofing a Canadian bank — is precisely the call least likely to arrive with meaningful attestation. Authentication raises the cost of spoofing across the network. It does not stop your phone ringing.

What does block calls in Canada

Blocking comes from a separate line of CRTC decisions, and from your carrier’s own systems:

• Non-conforming number blocking. Under Compliance and Enforcement and Telecom Regulatory Policy CRTC 2018-484, carriers block calls presenting numbers that could not possibly be dialled — malformed numbers such as 000-000-0000. Bell reports having blocked billions of these since January 2020. This is universal and requires nothing from you.
• Carrier analytics. Canadian carriers run their own CRTC-approved filtering. Bell has operated an AI-based scam-blocking system since July 2020. These services differ by provider and some are opt-in, so it is worth asking your carrier specifically what call filtering your plan includes.
• Traceback. From 25 June 2026, CRTC Decision 2026-52 requires all telecommunications service providers to take part in call traceback once they receive their first request. Providers must retain call data for at least ten calendar days, respond within two business days, and include the signing provider and attestation level where technically feasible. This does not stop a call reaching you, but it is how an operation gets found and cut off at source.

On your own handset

iPhone.Open Settings, find the Phone settings, and turn on Silence Unknown Callers. Calls from numbers not in your contacts, recent outgoing calls or Siri suggestions go straight to voicemail. The exact menu path shifts between iOS versions, so search Settings for “Silence” if it is not where you expect. Be aware this is a blunt instrument: a callback from a clinic, a delivery driver or a job interview will be silenced too.

Android.In the Phone app, open its settings and look for Caller ID and spam, Blocked numbers, or Call screening depending on your manufacturer and version. Google’s Phone app can screen unknown callers and filter suspected spam. Samsung, Pixel and other builds place these controls differently.

Blocking individual numbers barely works against spoofing,and it is worth being clear about why. A spoofing operation is not calling from the number you saw; it borrowed it for one call and will borrow a different one next time. Blocking that number blocks whichever innocent Canadian actually holds it. Neighbour spoofing — where the display matches your own area code and exchange to look local — makes this worse, because you may end up blocking your own community’s numbers one at a time. Silencing unknown callers as a category is the strategy that survives contact with the problem; blocking one number at a time is not.

The practical rule

Treat the number on your display as a claim, not evidence — even when a verification badge appears, and even when the number matches one you recognise. If a caller creates urgency and asks for money, credentials, a Social Insurance Number or remote access to a device, end the call, find the organisation’s number independently from an official website or the back of your card, and call it yourself. Nothing in STIR/SHAKEN replaces that habit, and it was never intended to.