The Only Way to Stop Spam Calls Is to Make Them Expensive

Current spam calls cost a fifth of a cent to place. Caller ID attestation enforcement is about to make that same call as much as a hundred times more expensive to place for attackers. At the peak of a targeted campaign, the majority of a business's inbound calls can be spam for days on end. Every spam call interrupts someone mid-task, mid-appointment, mid-conversation with a paying customer. Greet does not charge our customers for spam calls we cover all costs associated with mitigating these attacks. Over time we have built a ever sophisticed system to detect and block these calls automatically for our users. We are publishing the below anonomized data so others can learn from it.

The phone network was built to trust whoever calls

One of the reasons spam calls are so prevalent and cheap is because the phone network was built to trust whoever calls. Meaning any caller when placing a call can simply tell the phone network what number they are calling from and the phone network will display it. Spam callers use this to claim the phone call is coming from a phone number in your area so you are more likely to answer.

Modern spam calls use auto-dialers to dial thousands of numbers, when a user picks up the phone a pre-recorded auto message plays or the call is directed to a human operator that reads from a script. 48.9 billion robocalls in the United States in 2020, which has caused a collapse in how often anyone answers a number outside their contact list with one exception - businesses. Businesses answer all but the most suspicious calls automated systems detect and flag.

A decade of cat and mouse

Every defense so far has worked on the same principle-identify the bad number, then stop it.

Where the grade comes from

STIR/SHAKEN is the caller-ID authentication system that US and Canadian carriers have been required to run since 2021. When a call is placed, the carrier signs it with a digital certificate and attaches a grade describing how well it knows the caller. The receiving carrier checks that signature and passes the result along with the call.

The grade answers two separate questions: do we know who this customer is? and do they own the number showing on your screen?

What a spam campaign costs a business

Spam volume is not steady, it arrives in campaigns. That makes the worst month a poor guide to what a business should plan for, and the quietest one just as misleading. Across the last six months of data, the middle of that range looks like this.

Greet does not charge customers for spam calls and we automatically detect and block them. Customers can still view call logs and audio recordings but the majority of spam calls are prevented from reaching them.

What attestation does to the price of a spam call

The reason a decade of blocklists ran out of road is that phone numbers are free to a spammer. Spammers don't buy the numbers they call you from they simply claim they own it. A blocklist is useless against a spammer who uses a different number each time, which is precisely what neighbor spoofing does.

We see this in our own numbers. We run a commercial blocklist on every inbound call and it flags about a fifth of the spam we catch. On B graded calls, where most of the spam is, it flags around 3%. It works on callers who own their numbers and does almost nothing against callers rotating spoofed ones.

Attestation changes, because a grade that survives filtering requires actually holding the number you are calling from-bought from a provider that will vouch for you, under a name that provider has checked. Numbers stop being disposable and become inventory.

On its own, that is not much of a deterrent. A one-dollar number spread across a large campaign disappears into the rounding. The entire question is how many calls an attested number gets to make before its reputation catches up with it.

Burned after five calls, roughly where velocity limits would catch a classic auto-dialer, the number works out near 20¢ a call-two orders of magnitude above the call itself. Even at a hundred calls, about what an LLM-driven caller needs before it gives itself away, the number is still the dominant cost. Slower than that is bookkeeping rather than enforcement: the calls have already been made.

So attestation alone does not make spam expensive-attestation plus enforcement does. The grade is what makes enforcement possible: it ties traffic to an identity that costs money and paperwork to replace, so reputation and velocity limits finally have something durable to attach to. Get that pairing right and the oldest tool in the box works again-a shared list of known-bad numbers, which now takes real money to evade.

One honest caveat on the dollar figures: the dollar is not really the barrier, and a determined operation will pay it without blinking. The friction that actually bites is what sits behind the number-a provider that has to know its customer, and that can have its own signing token revoked for handing out grades it shouldn't. The cost being imposed is on identity, not on inventory.

Where we think this goes

Robot to robot. The majority of what we field is still cheap pre-recorded audio from auto-dialers cyling thorough local numbers. That is changing. As LLM-driven voice agents fall in price, we are seeing steadily more spam callers who sound and act like actual customers and can actually hold a conversation. For now they remain fairly easy to catch, because they are still reading from the same few dozen scripts the industry has run for a decade (expired auto warranty, unverified Google listing, solar assessment, final-expense policy, back-taxes settlement).

AI answering services like Greet are increasingly taking calls from adversarial agents, we expenct this trend to accelerate. We have a few novel approaches that are working well at scale, and we will write those up in a future post.

The web faced the same structural problem-anyone can claim to be anyone-and solved it the same way, with certificate authorities vouching for identity and browsers trusting the signature rather than the claim. It has not been flawless: an authority was compromised outright in 2011, and a major one was progressively distrusted by browsers in 2017-18 for sloppy issuance. But the model held, because the fix for a bad authority is to stop trusting it, and the ecosystem proved willing to do that. Telephony has the same lever-a provider's token can be revoked, and providers have already appealed revocations to the Commission-and the current rulemaking is largely about being readier to pull it. All considered, HTTPS has worked surprisingly well. That is the outcome to aim at.

Regulators are moving on the unsigned case first. In May 2026 the FCC issued a Further Notice of Proposed Rulemaking (FCC 26-32) that would, among other measures, require providers to block unauthenticated calls delivered directly to them-calls arriving with no signature at all-with an exception for public safety. It also proposes barring providers from routing calls over older networks in order to strip authentication along the way, and tightening the rules on which grade a provider is allowed to apply in the first place.

We suspect all attestion levels outside of A will be blocked within a few years. This will force spam callers to buy legitimate phone numbers spiking costs 10-100x current levels and opening them up to easier legacy spam tracking techniques. Spamers will not give up but instead shift to more sophisticated agent based spam calls. Because the minimum cost of a call will be 10-100x higher the attackers will be able to justify using more expensive agent based appraoch instead of the current pre recorded audio approaches.

For residential customers the solution is much easier than commerical businesses. They can silence or block calls from numbers outside their contact list. But businesses face a much tougher challenge as prospect customers could come from any number of sources.

About this post

Greet answers the phone for small businesses. Every call we handle carries its carrier grade, which lets us compare what the network claimed about a call against what the caller actually turned out to want. The figures here are drawn from a six-month sample, with calls classified from the transcript and outcome of each conversation.

What we withhold. Business identities, customer counts and call volumes are not published, and no figure here is stated in a form that lets you recover them-every number is a share of calls, rounded to the nearest whole percent. Spam classification counts telemarketing, robocalls and known-blocked numbers; silent calls are excluded from the spam figures rather than assumed to be robocalls.

Sources. Robocall volume: Twilio, Trusted Calling with SHAKEN/STIR. Blocklist history: FTC, Robocall Challenge winners (2013). Pending rulemaking and the quoted Commission reasoning on C-level attestation: FCC 26-32, Further Notice of Proposed Rulemaking, WC Docket No. 17-97 / CG Docket No. 17-59, released 21 May 2026.