Keeping Your Clients' Calling Reputation Clean

The MSP's Guide to VoIP: Part 20 of 20

Disclaimer: This post is educational content about caller reputation management and related compliance topics including the TCPA. It is not legal advice. Regulations change, interpretations vary, and your specific situation may differ from the general scenarios described here. Consult with a telecom attorney to determine how these regulations apply to your business.

The previous three posts covered the regulatory framework: what makes you a voice service provider, how STIR/SHAKEN authenticates calls, and what the Robocall Mitigation Database requires. That framework exists to combat robocalling and caller ID spoofing at a systemic level. This post is about the practical, ongoing work that happens after the framework is in place: the day-to-day reality of keeping your clients' phone numbers in good standing so their calls get answered instead of flagged, blocked, or ignored.

This is not a configure-once-and-forget task. Caller reputation is a living thing. It changes based on calling patterns, complaint activity, number history, registration status, and the constantly evolving algorithms that carriers and analytics companies use to score calls. An MSP that manages voice services needs to treat reputation management as an ongoing operational responsibility, not a one-time setup item.

How caller ID reputation actually works

When someone's phone rings, the decision about what the screen displays (the caller's name, a verified badge, a "Spam Likely" label, or nothing because the call was blocked) is made by a combination of systems that evaluate the incoming call in real time.

The carrier's own analytics engine evaluates the call based on STIR/SHAKEN attestation (covered in Post 18), calling patterns associated with the number, and any reputation data the carrier has for that number.

Third-party analytics companies like TNS (Transaction Network Services), Hiya, First Orion, and Nomorobo maintain their own databases of number reputation. Carriers license data from these companies to supplement their own analysis. The major wireless carriers each have relationships with one or more analytics providers, and the analytics that determine whether a call gets flagged vary by carrier.

The handset itself may apply additional filtering. Apple's Silence Unknown Callers feature on iOS, Google's call screening on Pixel phones, and third-party apps like Truecaller and RoboKiller all make independent decisions about how to handle incoming calls. These applications use their own databases, their own algorithms, and their own user-reported spam data.

The result is a multi-layered system where your client's call is evaluated by several independent entities, each with its own criteria, before it reaches the recipient. A number might show up clean on one carrier and flagged on another. It might be fine on AT&T but blocked by a third-party app that a particular recipient has installed. This fragmentation makes reputation management more complex but also more important, because you need to monitor across multiple systems rather than checking a single source.

Why legitimate business calls get flagged

This is the question MSPs hear most often, and the answer is rarely simple. The root of it is that STIR/SHAKEN verifies identity, not intent, so carriers layer analytics engines on top — and those engines make mistakes. Legitimate business calls get flagged for a range of reasons, often in combination.

Improper attestation

As covered in the STIR/SHAKEN post, calls that receive partial (B) or gateway (C) attestation instead of full (A) attestation are more likely to be flagged. This happens when the caller ID number is not properly registered with the signing provider, when the number was ported from another carrier and the registration did not follow, or when the trunk provider cannot verify the caller's authorization to use the number.

This is the first thing to check when a client reports spam labeling. Verify the attestation level their calls are receiving. If it is anything other than full, work with the trunk provider to resolve it.

Number registration gaps

Beyond STIR/SHAKEN registration, there are caller registry services that allow businesses to register their phone numbers and assert that they are legitimate business numbers. The most prominent is the Free Caller Registry (formerly known as the CNAM/caller ID registration ecosystem), but there are also carrier-specific registration programs.

Numbers that are not registered in these databases start from a neutral or negative baseline. The analytics engines do not know who owns the number, which means the number's reputation is determined entirely by its observed behavior. For a new number with no history, the algorithms may default to caution and flag it as unknown or potentially suspicious, especially if the calling pattern looks like it could be automated.

High-volume patterns that look like robocalling

This is where legitimate business operations can accidentally trigger spam detection. A sales team that makes 200 outbound calls per day from a single number exhibits a calling pattern that looks, to an analytics engine, very similar to a robocaller. Short call durations (because many calls go to voicemail), high call volume, and calls to numbers that never call back are all signals that analytics engines use to identify robocalling. Legitimate sales activity shares many of these characteristics.

The same applies to appointment reminder systems, collections calls, survey operations, and any other high-volume outbound calling. The behavior pattern matches what the algorithms are designed to detect, even when the calls are legitimate and wanted.

Numbers previously used by bad actors

Phone numbers get recycled. When a number is released by one customer and assigned to another, the new customer inherits whatever reputation the previous owner left behind. If the previous owner was a robocaller, or if the number was spoofed by robocallers (which does not require the number to have ever been legitimately assigned to them), the number may carry a negative reputation that has nothing to do with your client.

This is particularly common with new DID blocks from trunk providers. The provider may acquire a block of numbers that were previously in use elsewhere, and some of those numbers may have accumulated negative reputation. Your client gets assigned a "new" number that is already flagged as spam in multiple databases.

Client behavior that crosses lines

Sometimes the flagging is not an error. A client may be making calls that, intentionally or not, violate calling regulations or best practices. Outbound campaigns without proper consent, calling numbers on the Do Not Call registry, or using auto-dialers to call cell phones without prior express consent are all behaviors that generate complaints, and complaints drive reputation scores down.

This puts the MSP in a difficult position, because the client may not realize they are doing anything wrong, or they may understand the rules and be pushing the boundaries. Either way, the reputation consequences fall on the phone numbers you manage.

Monitoring reputation

Effective reputation management starts with monitoring. You need to know when a client's numbers are flagged before the client discovers it through declining answer rates and frustrated feedback from their contacts.

Checking against major databases

Several services allow you to check how a phone number is being categorized:

Free Caller Registry allows businesses to register their numbers and check their status across participating analytics providers. It is free and should be a baseline part of your number management process.

Carrier-specific portals. The major carriers (AT&T, T-Mobile, Verizon) have programs and portals where businesses can register numbers and dispute spam labels. Each carrier's program has different requirements and processes, and you may need to register with each one independently.

Third-party analytics providers. Companies like TNS, Hiya, and First Orion offer dashboards and APIs that show how numbers are scored. Some of these services are available directly; others are accessible through your trunk provider's platform.

Manual testing. The low-tech approach: call a number from the client's line and see what the recipient's phone displays. Test across carriers (call an AT&T cell phone, a T-Mobile cell phone, a Verizon cell phone) because the display can vary by carrier. This is not scalable, but it is a useful spot-check.

Watching answer rates

If you have access to call detail records and reporting through your trunk provider or wholesale platform, monitor answer rates over time. A sudden decline in answer rates for a specific number or a specific client is often the first signal that reputation has degraded. The analytics engines flagged the number before anyone reported it to you.

This kind of monitoring ties into the proactive monitoring practices we discussed earlier in the series. Adding caller reputation metrics to your regular review cycle gives you visibility into problems before they become client escalations.

Client feedback

Sometimes the first indication is a client telling you that their customers mentioned seeing a spam label. Take these reports seriously and investigate immediately. If one customer mentioned it, many others saw it and simply did not answer. The reported complaint is the tip of an iceberg of missed connections.

Build this into your support workflow. When a client reports a spam labeling issue, have a documented process: check attestation level, check registration status, check the number against major databases, review calling patterns, and escalate to the trunk provider if the issue is on their side.

Remediation

When a number is flagged, getting it unflagged requires addressing the root cause and then working through the various systems to update the reputation.

Registering with caller registry services

If the number is not registered with the Free Caller Registry and the carrier-specific registration programs, start there. Registration does not guarantee that a flagged number will be unflagged, but the absence of registration makes it harder to dispute a spam label. The registration creates a record that the number belongs to a legitimate business and provides a point of contact for disputes.

Working with the trunk provider on attestation

If the number is receiving less than full attestation, work with your trunk provider to resolve it. This usually means ensuring the number is properly registered in the provider's STIR/SHAKEN system and that the provider's signing infrastructure is correctly attesting calls from that number. If the number was ported in, the porting process may not have automatically updated the STIR/SHAKEN registration, and a manual update may be needed.

Disputing spam labels

Each carrier and analytics provider has a dispute process for challenging spam labels. The process typically involves submitting information about the business that owns the number, demonstrating that the calling activity is legitimate, and requesting a review. Dispute resolution timelines vary. Some providers resolve disputes in days, others take weeks.

Be prepared for the dispute process to be frustrating. You may need to submit information to multiple entities (the carrier, the analytics provider, the app developer) because each one maintains its own database and its own scoring. A successful dispute with one entity does not automatically propagate to others.

Getting new numbers

In some cases, the fastest path to clean calling is to replace the flagged number with a new one. This is a last resort because it means the client loses a number they may have had for years, and it creates disruption for anyone who has that number in their contacts. But if a number has been thoroughly poisoned, whether by its previous owner's behavior or by persistent spoofing, the effort required to rehabilitate it may exceed the effort required to transition to a new number.

If you go this route, make sure the new number does not have its own reputation problems before assigning it. Check new DIDs against spam databases before provisioning them for a client. Some trunk providers will work with you to select numbers that have clean history.

Adjusting calling patterns

If the flagging is related to high-volume calling patterns, the client may need to adjust their approach. Spreading outbound calls across multiple numbers rather than concentrating them on a single number reduces the per-number volume and makes the pattern look less like robocalling. Varying call timing rather than making all calls in a concentrated burst also helps.

Some businesses use dedicated outbound calling numbers that are separate from their main business numbers. This isolates the reputation risk. If the outbound calling number gets flagged, it does not affect the main number that clients use to call them back.

TCPA and business calling practices

The Telephone Consumer Protection Act (TCPA) predates the STIR/SHAKEN era, but it is deeply relevant to caller reputation because TCPA violations generate the complaints that drive reputation scores down.

The TCPA restricts how businesses can use automated dialing systems and prerecorded messages to contact consumers. The rules are detailed and have been the subject of extensive litigation, but the high-level principles that MSPs should understand include:

Prior express consent. Calling or texting a consumer's cell phone using an automatic telephone dialing system or prerecorded voice generally requires the consumer's prior express consent. For marketing calls, that consent must be in writing (which includes electronic consent). The definition of "automatic telephone dialing system" has been the subject of significant legal debate, but the safest approach is to assume that any system that dials numbers from a list without manual intervention is covered.

Do Not Call compliance. Businesses that make telemarketing calls must maintain and honor internal Do Not Call lists, and must scrub their calling lists against the National Do Not Call Registry maintained by the FTC. Calling a number on the Do Not Call Registry without an applicable exemption is a violation.

Revocation of consent. Consumers can revoke their consent to receive calls at any time, and the business must honor the revocation. A system that continues to call a consumer who has asked to be removed is generating violations that will eventually generate complaints that will eventually degrade the number's reputation.

Business-to-business exemptions. The TCPA's restrictions on autodialed calls and the Do Not Call Registry apply primarily to calls to consumers. Calls to businesses have different (generally less restrictive) rules. But the distinction between a consumer number and a business number is not always clear, especially with cell phones that are used for both personal and business purposes.

For MSPs, the TCPA relevance is twofold. First, if your clients are conducting outbound calling campaigns, their compliance with the TCPA directly affects the reputation of the phone numbers you manage. A client that ignores Do Not Call requests and generates complaints will damage their numbers' reputation, and by extension, your reputation as their voice provider. Second, the TCPA creates liability exposure for businesses that violate it, and clients who are not aware of their obligations may look to you for guidance because you are the technology provider.

You do not need to be a TCPA expert, and giving legal advice on TCPA compliance to your clients is not your role. But you should understand the basics well enough to recognize when a client's calling practices might be creating reputation risk, and you should be prepared to suggest they consult with their own legal counsel about their outbound calling practices.

Ongoing responsibility: this is not set-and-forget

The theme running through this entire compliance section of the series is that voice service obligations are ongoing. They do not end when you provision the trunk, configure the PBX, and port the numbers. The regulatory filings need to be maintained. The STIR/SHAKEN registration needs to stay current. The caller reputation needs to be monitored. The calling practices need to be compliant.

For MSPs who are accustomed to the managed services model, this should feel familiar. You do not patch a server once and walk away. You do not configure a firewall once and forget about it. You maintain, monitor, and adapt over time because the landscape changes. Caller reputation management is the same. It is an ongoing managed service responsibility.

Build it into your operations:

Quarterly reputation checks. Check your clients' primary outbound numbers against the major spam databases and carrier lookup tools. Flag any numbers that have been negatively categorized and initiate remediation.

Provisioning checklists. When you add a new number for a client, include caller registry registration, STIR/SHAKEN registration verification, and a clean-history check as standard provisioning steps.

Client onboarding. When you onboard a new voice client, discuss their outbound calling practices. Understand whether they do high-volume outbound calling, whether they use automated dialing, and whether they have TCPA compliance processes in place. Set expectations that their calling practices affect their phone number reputation.

Incident response. Have a documented process for when a client reports spam labeling. Know the steps: check attestation, check registration, check databases, review calling patterns, escalate to trunk provider, file disputes with carriers and analytics providers.

Renewal tracking. Track the renewal dates for your RMD filing, your upstream providers' RMD filings, your STIR/SHAKEN certificates (if you have your own), and any carrier-specific registrations. Missing a renewal deadline can have immediate operational consequences.

Wrapping up the series

This is the twentieth and final post in the MSP's Guide to VoIP. Over the course of this series, we have covered the full arc of building and operating a voice offering within a managed services business.

We started with the fundamental question of whether voice makes sense for your MSP and walked through the service models that determine how deep your involvement goes. We covered client expectations and the reality that voice support is different from data support in ways that affect your operations, your staffing, and your client relationships. We worked through the network assessment that needs to happen before you deploy a single phone, and the platform selection process that determines what your voice offering is built on.

We got into the operational details: trunk configuration, proactive monitoring, vendor relationships, and the specialized requirements of contact center environments. And in these final four posts, we covered the regulatory landscape that every voice provider needs to understand, from FCC classification to STIR/SHAKEN to the Robocall Mitigation Database to the ongoing work of maintaining caller reputation.

The through-line across all twenty posts is that voice is a serious commitment that rewards serious preparation. The MSPs that succeed with voice are the ones that invest in understanding the technology, build the right operational processes, hire or train for the right skills, and stay on top of the ongoing obligations. The ones that struggle are the ones that treated voice as just another product to resell without appreciating how different it is from the rest of their stack.

If you have read this far, you have a comprehensive foundation for making informed decisions about voice in your MSP. Whether you are just starting to evaluate the opportunity, actively building your voice offering, or looking to improve an existing offering, the information in this series gives you the context to do it well.

Voice is hard. But it is hard in ways that are knowable, manageable, and ultimately rewarding when you get it right. Your clients need their phones to work, and they need someone they trust to make that happen. If you decide to be that someone, do it with your eyes open and your operations solid. The rest follows from there.