STIR/SHAKEN in France

STIR/SHAKEN call authentication has been mandated in France. Compliance deadlines will be here soon. This article provides a brief overview of the French version of STIR/SHAKEN. Let’s have a look.

The French mandate was put in place to address a variety of telecommunications issues, including:

• Abusive telemarketing calls
• Fraudulent calls and messages, including vishing and smishing
• Spoofed telephone identity on calls intended to mask the identity of the caller
• Brand impersonation

The French program to address these problems includes STIR/SHAKEN call authentication.

Compliance deadlines in France

Let’s start with the compliance deadlines:

June 1, 2024: All operators must have deployed STIR/SHAKEN and must upload statistics to the MAN platform, a call authentication mechanism described below.

October 1, 2024: All operators must start blocking unauthenticated calls and calls that fail SHAKEN verification.

TransNexus has a STIR/SHAKEN solution that integrates with the French MAN platform API. This solution is currently in production use in France.

French call authentication law and entities

Next, let’s review the law that requires STIR/SHAKEN and the entities and elements involved in the French telecommunications ecosystem.

Naegelen: The French law that aimed at regulating telephone canvassing and preventing fraudulent calls.

ARCEP (Autorité de Régulation des Communications Électroniques, des Postes et de la Distribution de la Presse): French regulator that mandated STIR/SHAKEN.

APNF (Association de la Portabilité des Numéros Fixes): French number portability administrator, directed by ARCEP to drive STIR/SHAKEN deployment in France.

Fédération Française des Télécoms: French telecom industry association.

APNF directed the Fédération Française des Télécoms to establish technical and operational requirements for STIR/SHAKEN in France.

MAN (Mécanismes d’Authentification des Numéros): French STIR/SHAKEN Number Authentication Mechanism, an administrative platform that supports the technical and operational requirements devised by the Fédération Française des Télécoms. This platform handles STI-PA (Policy Administrator) and STI-CA (Certification Authority) functions and processes. The MAN platform is also used to collect call statistics from providers.

Requirements

Next, let’s review a summary of the French STIR/SHAKEN requirements.

Operators must:

• Ensure that caller ID numbers are authentic.
• Ensure that the end user is assigned the number or that the assignee has given consent for this use.
• Use an “authentication device” to confirm the authenticity of calls and messages.
  • The “authentication device” is STIR/SHAKEN.
• Ensure the interoperability of the authentication device, STIR/SHAKEN, by their reliance on technical standards developed jointly by operators.
• Block unauthenticated calls and calls that fail SHAKEN verification.

Comparison with call authentication in North America

The French law requires operators to block calls that are unauthenticated or fail SHAKEN verification, whereas the approach taken in the United States and Canada allows operators to relay and terminate calls and messages that are unauthenticated or fail verification.

France has one combined Policy Administrator and Certification Authority. These roles are fulfilled by separate entities in Canada and the U.S.

Operators must submit statistical reports to the MAN platform. This information will be used to measure the progress and effectiveness of the MAN platform.

TransNexus solutions

TransNexus is a leader in developing innovative software to manage and protect telecommunications networks. The company has over 25 years’ experience in providing telecom software solutions including branded calling, toll fraud prevention, robocall mitigation and prevention, TDoS prevention, analytics, routing, billing support, STIR/SHAKEN and SHAKEN certificate services.

Contact us today to learn more.