The function in a terminating network that checks the STIR/SHAKEN signature on an incoming call and reports whether verification passed or failed.
When a signed call arrives, the verification service extracts the PASSporT from the Identity header, retrieves the signer's certificate from the referenced URL, confirms that the certificate chains to a trusted CA, validates the signature, and checks that the token is recent and matches the calling and called numbers in the SIP signaling.
The outcome is typically expressed as a verification status, often carried onward in a "verstat" parameter so that downstream devices and apps can act on it. A passed verification combined with A attestation is a strong positive signal, but it is only one input; analytics engines also consider calling patterns, complaints, and the signing provider's history.
Verification services must be resilient. Certificate fetches add latency, so implementations cache certificates within their validity period and set sensible timeouts. A verification service that blocks calls while waiting on an unreachable certificate server can create outages of its own. Operators should also monitor failure rates by signing provider, because a sudden rise in failures from one source often points to a certificate or configuration problem rather than a wave of spoofing.
Why it matters to carriers
For terminating providers, the STI-VS feeds call labeling, blocking, and branded display decisions. Clean verification data also lets you spot upstream partners whose traffic consistently arrives unsigned or fails verification, which is useful evidence when you review interconnect relationships or respond to FCC questions about how you handle unauthenticated traffic.