05 Trust in Communications, Paper 4: The Permanent Coverage Gap

The Permanent Coverage Gap
Why Hardening Call Authentication Cannot Reach the Edges Where Fraud Routes
TRUST IN COMMUNICATIONS · PAPER 4 OF 7 · ICA AI, Inc. · +Trusted Infrastructure · July 2026

A +Trusted Infrastructure series from ICA AI
Series editor: John Perkins, Chief Executive Officer

The previous paper argued the relationship layer can stand alone; this paper sets it aside entirely and grants the identity approach every technical improvement it seeks. The argument is not that attestation failed. It contributed to a measured drop in number spoofing — a win it shares with enforcement, analytics, and labeling. The argument is that hardening attestation cannot reach the places fraud actually routes through, because what keeps it out of those places is economic, not technical. A mandate that lands at origin cannot close a gap that opens in transit and offshore. Coverage thins exactly where the incentive to authenticate is weakest, and the gap that leaves is permanent in a precise, bounded sense: it persists for as long as the economics that create it do, and nothing currently proposed changes those economics.

What authentication got right
Caller authentication — in the United States, STIR/SHAKEN — did real work. Attestation raised the cost of the crudest number spoofing and gave networks an accountability hook they did not have before. This paper does not call that a failure, and the distinction matters: the claim here is that attestation is narrow and insufficient, which is a different and more defensible statement than that it did not work. It worked, within bounds. This paper is about where those bounds are, why they are set by economics rather than engineering, and why that means they cannot be pushed outward by hardening the standard.

Participation up, coverage still short of half
The measured facts are uncomfortable for the hardening thesis. Even as more providers participate in call authentication, the share of calls arriving fully signed at termination has not kept pace — 48.8 percent as of June 2026, a recovery toward the 49.3 percent peak of October 2024 after a two-year slide, and still short of half. The majority of calls arrive without full-confidence attestation. Participation has risen for five years; coverage has yet to cross the halfway mark — and the recent recovery is the transport gap closing, exactly as the all-IP transition predicts, not the trust gap moving. And over the same years the coverage curve rose and stalled, while reported U.S. fraud losses climbed without pause — from $5.8 billion in 2021 to a record of roughly $16 billion in 2025. That divergence is the shape of the whole problem. It resolves into two distinct gaps, and a call is covered only if it clears both — signed at origin, and still carrying that signature when it arrives.

The first is the origin gap: calls that are never signed at all, because the originating segment had neither the incentive nor the capability to sign them. The second is subtler: a call can be correctly signed at origin and still arrive unsigned. As it crosses segments of the network that are not end-to end IP — older interconnects, certain international handoffs, gateways that translate between protocols — the signature can be stripped or lost in translation: the signature is built to ride on internet-era calls, and an older segment has no place to carry it — so the gateway passes the call along and the proof stays behind. The call that left the originating provider with a valid, top-grade attestation arrives at its destination carrying nothing. This is not hypothetical: of the calls that are signed at origin, only 44.5 percent reached the destination with the signature intact as of February 2026. More than half of the verification is lost somewhere in transit, and a call the system believes it can vouch for arrives as a call it cannot. The figures behind this section, and their sources, are collected in this series’ evidence companion, Voice Fraud: The Evidence.

The economics, not the technology
Why does coverage thin where it does? Follow the money: the pattern is not random. The segments where fraud concentrates — under-capitalized, high-churn, often offshore originators — are precisely the segments least able to afford, and least incentivized to deploy, full authentication. Signing calls costs money and effort; a fly-by-night originator that expects to be renamed and reconstituted within the year has no reason to spend either. Hardening the standard does nothing to that calculus. It raises the bar in the places already over it and leaves the places under it exactly where they were.

Picture a dam built taller across the main channel of a river while the water simply routes around the low banks. The channel is better protected; the total flow downstream is barely reduced, because the flow was never mostly in the main channel. Attestation hardens the main channel — the well resourced, compliant, largely domestic core of the network. Fraud is in the low banks, and always was. Building the main-channel dam higher is not wasted, but it is aimed at the water that was already contained, and it does not touch the water going around. The analogy has one limit worth naming, and it cuts the wrong way for the hardening thesis: water finds the low bank by accident, while fraud looks for it. An adversary chooses its route. If anything, the picture understates the problem.

The conflict at origin
There is a reason the incentive gap persists at origin, and again it comes from the government’s own record rather than from us. The originating providers asked to authenticate are, by the regulator’s own description of the market, compensated on the volume of calls they carry, not on the integrity of those calls. That is exactly why the top attestation grade is routinely held by prolific robocallers — among the ten most prolific robocall-signing providers, 97.4 percent of calls carry A-level attestation, the highest grade the framework issues. The grade distribution across all traffic tells the same story. Measured against all calls, A-level accounts for 30.8 percent, B for 4.4, and C for 7.8 — 43.0 percent carrying a graded attestation, against the 48.8 percent that arrive signed. When calls get signed at all, they overwhelmingly get signed at the top: of the traffic that carries a grade at all, nearly three quarters carries the highest one. Authentication is being issued, at the highest grade, to the very actors it was meant to deter, because the party issuing it is paid to carry calls, and the grade it issues certifies where a call entered the network, not whether it should be trusted. No hardening of the grading standard changes an incentive that runs the other way; a more rigorous grade issued by a party paid to issue grades is a more rigorous stamp on the same incentive.

From the attester’s own seat, none of this is irrational — the provider is responding exactly to the incentive it was given. An originating provider paid on volume wants to carry as much traffic as it can and to keep its customers, who are the callers. Assigning a high attestation grade keeps traffic flowing and customers happy; it costs the provider nothing directly when a high-graded call turns out to be fraudulent, because the grade certifies origin, not conduct, and the consequences of the conduct land downstream on the recipient. So the rational move, for a provider optimizing the incentive as written, is to attest generously. The grade drifts upward not because anyone is cheating but because the system pays for volume and asks for integrity, and when those two pull apart, the party in the middle follows the one that pays. This is the deep reason the top grade ends up on the worst traffic: it is the predictable output of the incentive, not an aberration in it, and a standard that grades more strictly without repricing the incentive simply produces stricter grades pointed at the same calls.

Mandates cannot fix affordability
The industry’s answer is regulation — the FCC’s proposed know-your-customer and know-your upstream-provider requirements, detailed in this series’ companion on the proposed rules. Grant that they help; they raise the floor and close some of the crudest origin gaps. They still do not touch the affordability problem. A mandate can require authentication, but it cannot make authentication economical for an under-capitalized offshore originator, and it cannot reach a foreign segment outside its jurisdiction. And these requirements are, as of this writing, proposals — origin-level, years from full effect, with continuous know-your-customer still a proposal in a rulemaking rather than adopted law. A rule that lands at origin cannot close a gap that opens in transit, where signatures are stripped, or offshore, where the rule does not reach. The mandate and the gap are, structurally, in different places.

A gap with a passport
The affordability gap has a geographic twin, and the two reinforce each other. A large share of the fraud that reaches domestic phones originates in, or is laundered through, segments of the network that sit outside the reach of any single national regulator. A rule written in one jurisdiction binds the providers it can name; it does not bind a foreign originator, and it does not bind the intermediate carrier in a third country that hands the traffic along. The call arrives domestically, but the point where it should have been authenticated sat in a place the rule could never touch. This is not a loophole to be closed by tighter drafting — it is a boundary of sovereignty. Authentication mandates are national; the fraud economy is not, and a gap that opens outside the jurisdiction cannot be closed by a rule inside it, however well written. The border gap and the affordability gap fail the same way: the rule lands in one place, and the party who would have to comply is in another.

What hardening can buy, and what it cannot
The case for simply doing more hardening conflates two different things: what a stronger standard can buy, and what it cannot. Hardening can buy three real things: a higher cost for the crudest impersonation, a firmer accountability hook inside the compliant core of the network, and a cleaner signal on the calls that are signed and stay signed. Those are worth having. What hardening cannot buy is the larger remainder of the problem. It cannot make signing economical for an originator that expects to disappear and reconstitute under a new name. It cannot reach an actor outside the jurisdiction. And it cannot keep a signature intact across a segment that strips it. No increment of rigor moves an item from the second list to the first, because the items on the second list are not failures of rigor — they are failures of reach, economics, and sovereignty, and a better standard does not address them. This is why the debate about how much more to harden, however earnest, is aimed slightly past the problem: it is optimizing the part that already works while the part that does not sitsoutside its reach.

Why the gap persists
The gap is durable — stronger than temporary, short of eternal — because its cause is structural, not incidental. Costs could fall; attestation could reach further; some of this could change. What does not change easily is the shape of the problem. Fraud concentrates at those same edge segments — the pattern that enforcement records and the robocall-signer data both point to — and they are precisely where the economics of authentication break down. And between origin and destination, the legacy segments that strip signatures in transit are receding — carriers are retiring copper and TDM against real schedules — but they are not disappearing uniformly or all at once, and the international and edge segments where fraud is most likely to route are the last to convert. That transit gap shrinks with the all-IP transition. It is the smaller of the two gaps, and the transitional one.

The larger gap is not about transport at all. Even on a network that is fully IP end to end, where every signature survives and every eligible call is signed, authentication would still certify only where a call entered the network and under what claimed authority — not whether the communication should reach the person on the other end. Grant STIR/SHAKEN its best possible future — complete IP coverage, universal signing, no transit loss — and the trust decision is still unmade. The transport gap shrinks. The trust gap does not.

No amount of hardening at the well-resourced center changes the economics at the under-resourced edge. Permanent, then, is shorthand — precise shorthand: the transport gap fades with the transition, but the trust gap beneath it persists for exactly as long as authentication is asked to answer a question it was never built to answer. That leaves one more question worth asking on the identity approach’s own terms. Suppose the proposed rules worked perfectly anyway — flawless rollout, full compliance. Would even that be enough? The next paper grants exactly that assumption.

Figures cited in this paper
Share of calls arriving fully signed at termination: 48.8 percent (June 2026), a 20-month high, recovering toward the 49.3 percent peak (October 2024); the majority still arrive without full-confidence attestation. TransNexus. Of calls signed at origin, the share arriving with the signature intact: 44.5 percent (February 2026). Grade split at termination, as a share of all calls: A 30.8 percent, B 4.4 percent, C 7.8 percent — 43.0 percent graded; among the top-10 robocall signers, 97.4 percent of calls at A-level (June 2026). Reported U.S. fraud losses: $5.8 billion (2021) to roughly $16 billion (2025), FTC Consumer Sentinel. Figures as of this writing; sources and fuller data in the companion, Voice Fraud: The Evidence.

About this series
Trust in Communications is a seven-part white-paper series, with two companion volumes and a concluding epilogue, examining one question: whether verifying identity is enough to establish trust in voice communications. The list below is in reading order — the companions sit where they are best read, not at the end.

1. What Trust Actually Is
   ◇ Companion — Voice Fraud: The Evidence
2. The Role of Caller Authentication in Establishing Trust
3. The One Layer That Can Stand Alone
4. The Permanent Coverage Gap (this paper)
5. Even If the Proposed FCC Rules Work Perfectly, Will They Be Enough?
   ◇ Companion — The Proposed FCC Rules
6. Why a Relationship Cannot Be Faked at Scale
7. The Compromised Account
   ◆ Epilogue — What Changed, What Remains True
   Read the full series at ICATrusted.ai.

Drafted with AI assistance; all analysis, claims, and conclusions rest with the series editor.