02B Trust in Communications, Companion A: Voice Fraud – The Evidence

The third-party evidence for the negative case — that attestation is narrow, the threat has migrated, and the share of signed calls is uneven and, after five years, still a minority.

COMPANION VOLUME · ICA AI, Inc. · +Trusted Infrastructure · July 2026
A +Trusted Infrastructure series from ICA AI
Series editor: John Perkins, Chief Executive Officer

Note: Every figure in this volume carries a named third-party source and a date; the fastest-moving figures are refreshed each quarter.

How to use this document
This is the reservoir. It carries no argument of its own; it holds the dated, sourced facts that every other paper in the series draws from, so the arguing papers can cite one common evidence base instead of each re-sourcing the same numbers. Read it as a reference, not a narrative. It is the canonical evidence repository for the series: when a statistic changes, it changes here first, and the papers inherit the update through their citations.

Read this first: it is the standing rule for the companion. Every figure that follows resolves to a named, dated, third-party source, and every paper cites this shared base rather than re-sourcing its own numbers.

A note on scope — This document gathers the negative case only: the third-party, dated evidence that verifying identity is not sufficient for trust — that attestation is narrow, that the threat has migrated past it, and that the share of signed calls is uneven and still short of half after five years of mandate. That case is built entirely from independent sources and is fully citable. The positive case — the claim that relationship-based trust outperforms identity — is deliberately excluded, because it is ICA AI’s own thesis, argued in the papers and not yet independently established. Keeping the two apart is what lets everything here stand as fact anyone can check.

A discipline note that runs through every section: where a trend has several causes, this document says so. The measured drop in spoofing over recent years was driven by enforcement, call analytics, and labeling rolled out at the same time as attestation — attestation earned part of that win, not all of it. Crediting it honestly is what keeps the rest of this document credible.

Attestation coverage — what is actually signed
STIR/SHAKEN signs a minority of the calls that reach American phones. As of June 2026, signed calls were 48.8% of all calls observed at termination — a 20-month high, recovering toward the October 2024 peak as the all-IP transition retires the segments that strip signatures — with the highest attestation level (A) accounting for 30.8% and B for 4.4%. Five years after the mandate, fewer than one call in three arrives with the full-confidence attestation the framework was built to produce, and the overall share has yet to cross half. The trajectory from the same source’s monthly statistics: roughly 24% at year-end 2021 — stuck there since August 2021 — 26.2% at year-end 2022, 33% at year-end 2023, a 49.3% peak in October 2024 falling to 47.0% by December, a slide to 42.3% by April 2026, and a recovery to 48.8% in June (TransNexus monthly STIR/SHAKEN statistics, 2021–2026). The recovery is transport, not trust: what is rising is the share of calls whose signature survives the path — the grade distribution, and who holds the top grade, are unchanged.

Two figures in that table matter more than the headline coverage number, and both cut against attestation as a trust solution:

TransNexus / ACA Int’l
The signature often gets stripped in transit. In February 2026, only 44.5% of calls that were signed at origin still carried an intact signature when they reached the destination. Roughly half the verification is lost in transit, principally where calls cross older non-IP (TDM) network segments that strip the SIP Identity header (documented as a mechanism in Section 5). A trust signal that disappears mid-path for half of traffic cannot be the layer trust rests on.

The same 100%, twice divided — once at the origin, once in transit.

The legacy segments where this happens are not a rounding error. Among smaller carriers, only 17.5% of the call traffic between them was signed in 2025 (TNS, 2026 Robocall Investigation Report). About 83% of rural carriers (NTCA members) report at least some IP switching in their networks — leaving a real minority with none (NTCA comments to the FCC, 2025). And even on Tier-1 networks, roughly 40% of traffic in places lacks a signature because of TDM bypasses (TNS). Each figure measures a different slice, but together they show how much of the network still cannot carry an authenticated signature.

Fraudsters hold A-level attestation. Among the ten most prolific robocall-signing providers, 97.4% of calls carried A level attestation — the highest trust level the framework issues. Attestation certifies that a provider vouches for the caller’s right to use a number; it does not certify that the call is wanted, honest, or from who the recipient thinks. High-volume robocallers routinely obtain the top grade. This is the single most important fact about attestation as a trust signal: it is present and green on calls the recipient would never want.

Framing discipline — This is narrow-and-insufficient, not failure. Attestation measurably reduced number spoofing and is a genuine, useful hardening of the origin layer. The point is not that it broke; it is that it grades where a call entered the network — not who is behind it, and not the trustworthiness of the relationship behind it — and it is issued at the top level to the exact actors the recipient wants screened out.

Volume — the unwanted-call picture
Total robocall volume has plateaued while the composition has shifted toward the calls people least want. U.S. consumers received 52.5 billion robocalls in 2025 — essentially flat against 52.8 billion in 2024 (down less than 1%). But within that flat total, unwanted telemarketing and scam calls rose to 29.6 billion, or 57% of all robocalls, up from 49% the year before — a 15.4% year-over-year increase in the worst category even as the overall number held steady. Notifications and payment reminders (the benign categories) fell.

The story the volume data tells is not that calling is being cleaned up. It is that the mix is getting worse: the wanted, informational calls are receding and the unwanted, higher-risk calls are taking their place — during the same period attestation coverage stopped growing.

Fraud losses — the government-sourced thesis
This is an important line of evidence in the series, because it comes from a neutral government source and points in the opposite direction from attestation coverage. Reported U.S. fraud losses have risen every year while attestation was rolled out and hardened, reaching $12.5 billion in 2024 and a record of approximately $16 billion in 2025 — a 25% jump in a single year.

The 2024 jump was not an artifact of more people complaining. The number of reports was roughly stable; what rose was the share of reporters who actually lost money — from 27% in 2023 to 38% in 2024. More of the fraud that was attempted succeeded.

Where the phone sits. Across contact methods, email is the #1 method fraudsters use to reach victims, phone calls are #2, and text messages #3. Investment scams led all categories at $5.7 billion, with imposter scams second at $2.95 billion (government-imposter alone $789 million).

On the fraud-loss figure — The $12.5 billion covers all fraud across every channel, not phone alone. From a neutral, government source, attestation coverage rose over the same years that reported fraud losses rose — consistent with the losses migrating to vectors attestation cannot see.

Threat migration — why the threat outran the standard
Attestation answers a question about the origin of a call. The threat has moved to a question attestation never asked: is the voice on the line who it claims to be? AI voice synthesis has turned that from a corner case into a mainstream attack in roughly two years, and the third-party measurements are stark.

The supply side — synthetic voice at scale
Pindrop’s 2025 Voice Intelligence & Security Report (released June 12, 2025) recorded a 1,300% increase in deepfake fraud over 2024, measured across 1.2 billion customer calls, and a 173% rise in synthetic-voice calls between the first and last quarter of 2024. Pindrop separately reports flagging roughly seven deepfake calls per customer per day by the end of 2024, against about one per month across its entire customer base beforehand. Pindrop’s own release quotes those two figures together as though they measured the same thing. They do not — the bases differ — and they are reported apart here. In U.S. contact centers, a fraud attempt now occurs on average every 46 seconds. Synthetic-voice attacks rose 475% in insurance, 149% in banking, and 107% in retail in a single year, and Pindrop put 2025 contact-center fraud exposure at $44.5 billion.

The demand side — what consumers are already seeing Hiya’s State of the Call 2026 (released March 2, 2026) found that 1 in 4 Americans received an AI deepfake voice call in the prior twelve months, and a further 24% are not sure they could tell a deepfake from a real call — so nearly half the population has either encountered AI voice fraud or cannot reliably distinguish it. The 24% is uncertainty, not measured failure: Hiya’s wording is that they “aren’t sure they could tell the difference.” Asked who is winning the fight between carriers and scammers, consumers picked the scammers by nearly two to one. Unwanted calls now run 9.9 per week per person and have grown 16% compounded annually since 2023; 38% of subscribers say they would switch providers over inadequate AI-scam protection.

The common thread: every one of these attacks can, in principle, ride a properly attested call. Number attestation and voice authenticity are independent — neither tells you anything about the other. A correctly signed A-level call can carry a cloned voice. The standard hardened the origin while the threat moved to the content and the relationship.

The mid-path laundering mechanism (documented as fact)
When a call crosses from IP to legacy TDM and back to IP, the SIP Identity header that carries the STIR/SHAKEN signature is stripped at the TDM segment. The call then re-enters an IP network unsigned and is re-attested downstream — often at the lower C level, but per that same account sometimes re-signed at A by the re-originating provider. Deliberate header stripping by rogue or loosely regulated intermediate providers produces the same result on purpose.

The measured consequence is in Section 1: only 44.5% of signed calls arrive with their signature intact (February 2026). A signal that is silently regenerated mid-path — and can be upgraded to full attestation after the original chain of custody is broken — carries information about the last hop, not about the caller. A signal with those properties cannot be load-bearing for the trust decision.

Regulatory status — the backbone
The regulatory record here was verified against primary sources; this section summarizes it and re-confirms the fast moving dockets as of this document’s date. The single most important discipline: distinguish adopted rules from proposals, and origin-level obligations from relationship-level ones.

The enforcement record — how removal has actually been used. The expanded certification requirements set a compliance deadline of February 26, 2024. After more than 2,000 providers failed to meet it, the Enforcement Bureau issued a show-cause order in December 2024 directing 2,411 providers to cure their filings or face removal. On August 6, 2025, the Bureau removed an initial 185 providers from the database; on August 25, 2025, it removed the certifications of more than 1,200 more — the first mass sweep in the database’s history. On January 2, 2026, it removed 1,203 more. Removed providers may not refile without prior approval from the Enforcement and Wireline Competition Bureaus. From missed deadline to disconnection: eighteen months. (FCC Enforcement Bureau, Aug 6 and Aug 25, 2025.)

The distinction that matters. Even at its most expansive proposed form, the regulation operates at the origin/provider level — a carrier vetting who is allowed to originate traffic. Nothing adopted or proposed reaches the pair-level relationship layer — who actually trusts whom. The regulatory record leaves the category question entirely intact, which is itself a finding: neither pole can claim the FCC as an ally on the category.

What this evidence supports — and what it does not
Stated plainly, so no paper built on this reservoir overreaches:

Supported, and fully citable (the negative case):
Attestation signs a minority of calls (48.8%) and has yet to cross half after five years of mandate; roughly half of signatures are lost in transit; the highest attestation level is routinely held by prolific robocallers; unwanted calls are rising as a share of a flat total; reported fraud losses hit a record of approximately $16B in 2025 (up ~25% over $12.5B in 2024) with a rising success rate; and the threat has migrated to AI voice, which rides attested calls untouched. All third-party, all dated.

NOT supported here, and deliberately excluded (the positive case):
That relationship-based tracking outperforms identity is a claim this document does not make, because it is not yet external, third-party research — it would be ICA’s own claim to prove, not an independent finding. Until it is, it stays out of this evidence base. Keeping it out is what makes everything above trustworthy.

Bottom line — The evidence cleanly establishes that attestation is narrow, leaky in transit, blind to voice authenticity, and issued to bad actors — and that the threat has moved past it while losses climbed. That is the whole burden this document needs to carry. The case that relationship-based trust does better is made elsewhere, in the papers, and rests on its own separate evidence.

Sources & verification log
All figures below are current as of the dates shown. Coverage and threat figures move within a quarter; the dated dockets and monthly statistics are the authoritative current source.

Primary sources: transnexus.com/blog/2026/shaken-statistics-April; acainternational.org (STIR/SHAKEN Feb 2026); YouMail Robocall Index 2025 year-end release; ftc.gov Consumer Sentinel Network Data Book 2024 (and the March 2025 press release) — the 2025 calendar-year figure comes from FTC congressional testimony of April 2026, not from a 2025 Data Book, which had not been published as of this writing; Pindrop 2025 Voice Intelligence & Security Report; hiya.com State of the Call 2026; docs.fcc.gov FCC-26-27A1 and related dockets; FCC Enforcement Bureau RMD removal orders — DOC-413519A1 (Aug 6, 2025) and DOC-414073A1 (Aug 25, 2025); further removal order, Jan 2, 2026.

Drafted with AI assistance; all analysis, claims, and conclusions rest with the series editor.