Businesses face two different errors: accepting a malicious call and rejecting a real customer. The FCC's public unwanted-calls dataset shows the scale of the first problem—about 1.8 million complaint rows covering reports from October 31, 2014 onward when checked in August 2026—but it does not estimate the share of calls received by an individual business.
Authentication is evidence, not identity
STIR/SHAKEN helps originating and terminating providers convey whether the calling number was authenticated. It does not certify the caller's story, authority, or intent. A valid number can belong to a compromised account, while a legitimate call can arrive without the strongest attestation because of network and routing conditions.
That makes a binary “verified equals safe” rule unsuitable for an answering team. Caller ID is a routing clue. Sensitive action requires a separate verification step using a known record or an outbound channel already controlled by the business.
A three-lane intake protocol
Use observable behavior rather than accents, geography, or caller demeanor:
- Ordinary service request: collect the minimum callback and service details, then route normally.
- Uncertain or unsolicited request: record the claimed organization and purpose; do not disclose customer, employee, schedule, or account information.
- Sensitive instruction: refuse credential, payment, bank-change, reset-code, or protected-record requests until an authorized employee verifies through a known number or system.
The receptionist should never read one-time codes aloud, install software, transfer money, or confirm whether a named person is present. CISA's social-engineering guidance supports slowing down and verifying requests through trusted channels.
Measure both kinds of error
Review a weekly sample of blocked, challenged, and accepted calls. Report:
| Measure | Denominator |
|---|---|
| Challenge rate | all answered inbound calls |
| Confirmed unwanted rate | reviewed challenged calls |
| False-positive rate | reviewed challenged calls later confirmed legitimate |
| Sensitive-action escapes | reviewed calls that bypassed verification |
| Real-caller recovery time | falsely challenged legitimate calls |
Do not compare complaint counts across years without checking dataset definitions and reporting behavior. FCC complaints are consumer reports, not a random sample of all calls. FTC complaint totals have the same self-selection limitation.
Operational implication
A trained live answer can preserve access while putting a controlled pause before risky actions. Start with a written escalation matrix and five prohibited disclosures. Then test it with benign simulations and review false positives. See our research on caller hang-up thresholds for the queue side of the problem and the services overview for coverage options.
FAQ
Does a verified caller-ID badge prove a caller is trustworthy?
No. Authentication concerns use of the number in the call path; it does not validate the caller's claim or requested transaction.
Should a business block every call marked spam?
Not automatically. Measure false positives and provide a safe recovery route for legitimate callers.
What is the safest rule for sensitive calls?
Do not act on inbound instructions alone. Verify through a known record and an independently controlled channel.