Phone Number Reputation: How Carriers Score and Label Calls

You dial a customer, the call connects, and their phone shows “Potential Spam” before you say a word. Nothing changed on your end. Your number, your PBX, and your carrier are all the same as last week. What changed is your phone number reputation, the running risk score that analytics companies and terminating carriers attach to every number on the network.

That score is what decides whether your call rings through clean, arrives with a “Scam Likely” banner, or gets silently sent to voicemail. It is calculated by a handful of analytics providers, fed by call-pattern data and consumer complaints, and increasingly cross-checked against the cryptographic trust signal that STIR/SHAKEN carries in the call. Here’s what we’ll cover: what a reputation score actually is, who calculates it, why legitimate numbers get flagged, how to run a phone number reputation lookup, and what you can control at the network edge to protect the numbers you originate.

What Phone Number Reputation Actually Is

Phone number reputation is a risk score, not a fixed property of your number. Every time a number places calls, that activity feeds a model, and the model outputs a rating that terminating carriers use to decide how the call should be presented. The score moves. A number with a clean history can pick up a spam label in days if its behavior suddenly looks like a robocaller’s, and a flagged number can recover once the bad pattern stops.

The important thing to understand is that the label lives on the receiving side, not with you. When a recipient sees “Potential Spam,” that text was added by their carrier or by an app on their phone, using a score calculated by a third-party analytics provider. You never see it on your own outbound call, which is exactly why the problem is so easy to miss until customers start mentioning it.

It helps to separate two things that often get confused. Reputation is a probabilistic judgment about whether a number is likely to be unwanted, built from behavior and complaints. STIR/SHAKEN attestation, by contrast, is a cryptographic statement about whether the originating provider vouches for the number. They are related but not the same: attestation is one input a reputation model can weigh, but a fully attested number can still earn a bad reputation if it behaves badly, and a poorly attested number is simply easier to distrust.

Who Calculates the Score

There is no single national spam registry that carriers all read from. Instead, a small set of independent call-analytics providers each score numbers and sell those verdicts to carriers and consumer apps. The three most influential are Hiya, First Orion, and TNS (Transaction Network Services), and they do not agree with each other. Each runs a different model on a different data set, which is why the same number can look clean on one mobile network and flagged on another.

That fragmentation is the single most confusing part of the topic for operators. There is no one place to fix a label, because there is no one label. A number is scored many times, by many engines, and each carrier chooses which engine’s verdict to trust and how to display it. When you place a test call to a Verizon phone, a T-Mobile phone, and an AT&T phone, you are effectively querying three different opinions of the same number.

The Signals That Feed the Model

Analytics providers keep their exact formulas private, but the categories of input are well understood across the industry. A reputation model generally weighs the following:

• Call velocity and volume covers how many calls a number makes and how fast, since a spike from a normally quiet number reads like an autodialer starting a campaign.
• Answer and rejection behavior matters because a high volume of very short or unanswered calls is the classic fingerprint of unwanted dialing.
• Consumer complaints feed the model directly, as reports from spam-blocking apps and carrier “report spam” buttons push a score down quickly.
• Duration patterns help distinguish real conversations from dial-and-hang-up traffic, so consistently sub-ten-second calls raise suspicion.
• STIR/SHAKEN attestation acts as a trust modifier, where A-level attestation supports the number and low or absent attestation removes a layer of defense.
• Number and block history counts too, because a number recently reassigned from a known bad actor can inherit suspicion before it places a single call.

None of these signals is decisive on its own. The model combines them, which is why the practical takeaway is behavioral: the way to hold a good reputation is to make your calling patterns look like the legitimate business you are, not like the campaigns the models are trained to catch.

Why Legitimate Calls Get Labeled Spam

“Why are my calls labeled spam?” is the question that brings most people to this topic, and the frustrating answer is that a spam label is a statistical judgment, not an accusation of wrongdoing. Legitimate businesses trip the models constantly. Here are the patterns that do it most often.

High-Volume Outbound That Looks Like a Campaign

A collections team, an appointment-reminder system, or a contact center that ramps from a cold start to hundreds of calls an hour produces exactly the velocity signature the models are trained to flag. The intent is legitimate. The traffic shape is identical to a robocall campaign, and the model cannot read intent.

Low Answer Rates and Short Calls

If people do not pick up, or hang up quickly once a label appears, the model reads that as confirmation that the number is unwanted. This creates a spiral: a marginal label suppresses answers, the low answer rate deepens the score, and the number slides from “Potential Spam” toward outright blocking.

Weak or Missing Attestation

If your originating provider signs the call with B or C-level attestation, or does not sign it at all, the call arrives without the strongest available trust signal. That does not by itself brand you as spam, but it removes a layer of protection the analytics engines would otherwise credit. This became a live problem when upstream carriers began downgrading wholesale traffic’s attestation, pushing providers toward A-level self-attestation to hold their standing.

An Inherited or Spoofed Number

Numbers are recycled. A DID that a prior owner used for aggressive dialing can carry that history into your hands. Separately, if fraudsters spoof your number as the caller ID on their own traffic, the reputation damage lands on you even though you never placed the calls. Both are common, and neither is your fault, which is why a periodic reputation check on your own number range is worth the effort.

How to Run a Phone Number Reputation Lookup

Because reputation is fragmented across carriers and analytics engines, a phone number reputation lookup is really a set of checks rather than one query. The goal is to see your number the way each network sees it. A practical approach layers three methods.

1. Place live test calls across all three major carriersCall a phone on each of Verizon, T-Mobile, and AT&T and note the exact on-screen label. This is the ground truth, because it shows what your actual customers see. Repeat from every number range you originate from, since reputation is per-number, not per-account.
2. Use the analytics providers’ own lookup and remediation portalsHiya, First Orion, and TNS each publish a way to check a number’s status and, where warranted, request review or registration of a legitimate business number. Because carriers subscribe to different engines, checking each one tells you which network the problem lives on.
3. Query a spam-risk data source programmatically from your own networkFraud and spam APIs such as YouMail return a machine-readable risk level for a calling number. Wired into the routing layer, this lets you monitor your own number ranges continuously instead of discovering a problem only when a customer complains.

The programmatic path is the one operators underuse. A live test call is a snapshot, but an API query at the network edge is a monitor. The YouMail spam-risk integration, for example, returns a simple three-level verdict: level 0 means the number appears valid, level 1 means it looks like a spammer but the data is inconclusive, and level 2 means there is strong evidence of spam. Reading that value on your own traffic turns reputation from something you find out about into something you watch.

What You Can Control at the Network Edge

You cannot rewrite an analytics provider’s model, and you cannot force a terminating carrier to trust you. What you can control is the quality of the signals your calls carry when they leave your network, and that control lives at the Session Border Controller. The SBC is the last point you own before the call enters the wider network, which makes it the natural place to shape reputation-relevant behavior.

Sign Calls With Honest, Correct Attestation

The strongest thing you can do for a number’s standing is attach accurate STIR/SHAKEN attestation to every call. In a programmable SBC, attestation is a per-call decision rather than a blanket setting, because a single network usually carries mixed traffic: retail customers you can fully vouch for, wholesale traffic you know less about, and gateway traffic from untrusted sources. Signing each call at the honest level supports the reputation of the numbers you genuinely stand behind.

Score Outbound Traffic Before It Leaves

The same spam-risk data the analytics engines use is available to you through fraud APIs. Wiring a real-time fraud and spam scoring query into the routing path lets the SBC check its own outbound numbers, flag a range that is drifting toward a bad score, and route around the problem before customers ever see a label. On ProSBC this runs as a routing-script filter that queries a partner such as TransNexus ClearIP, SecureLogix, or YouMail during call setup and applies the verdict to routing.

Enforce Do-Not-Originate and Rate Control

A big share of reputation damage comes from spoofing, where someone else places calls using your number as the caller ID. Enforcing a Do-Not-Originate list blocks calls that claim to originate from numbers that should never dial out, cutting off a common spoofing vector. Pairing that with per-number rate control keeps your own legitimate traffic from producing the velocity spikes that read as a campaign, so you look less like the thing the models hunt for.

Watch the Signals You Send

Reputation is downstream of behavior, and behavior is visible in your own call detail records long before a label appears. Monitoring answer rates, call durations, and rejection patterns per number range at the SBC gives you an early warning. If a range’s answer rate is falling and its short-call count is climbing, its reputation is about to follow, and you can intervene while it is still cheap to fix.

Reputation, Attestation, and Spam Labels: How They Relate

These three concepts get blurred together constantly, which leads people to chase the wrong fix. This is how they actually divide up.

Concept	What it is	Who sets it	What you control
Phone number reputation	A probabilistic risk score from call behavior and complaints	Analytics providers (Hiya, First Orion, TNS)	Indirectly, through behavior and signals
STIR/SHAKEN attestation	A cryptographic statement of how well you know the caller	The originating provider	Directly, at signing time
Spam label	The text shown on the recipient’s screen	The terminating carrier or a consumer app	Not directly

Reading across the table makes the strategy obvious. You cannot set your own label and you cannot set your own reputation, but you can set your attestation honestly and you can shape the behavioral signals that feed the score. Those two levers are where the effort pays off, and both of them live at the network edge.

Frequently Asked Questions

Conclusion

Phone number reputation is a moving score, calculated by a handful of independent analytics providers, applied on the receiving side, and driven mostly by how your numbers behave. You cannot edit the score directly and there is no master registry to appeal to, so the leverage is in the signals you send: honest STIR/SHAKEN attestation, calling patterns that do not mimic a campaign, protection against spoofing, and continuous monitoring of your own ranges.

All of those signals are set at the network edge. The practical next step for any operator seeing spam labels on legitimate traffic is to run a reputation lookup across the three major carriers, then move the fix upstream to the SBC, where attestation, spam scoring, Do-Not-Originate enforcement, and rate control all live in one place.