Telecom’s fight against rampant identity fraud and financial crimes

As scam and spoofed calls continue to rise, Lucy Yang examines how Branded Calling and decentralised identity can help telecom providers verify businesses and rebuild consumer trust.

When did you stop answering calls from unknown numbers? For me, that shift happened when spam and scams began dominating my incoming calls. Today, my strategy is simple: if an unrecognised number calls repeatedly, I screen it online, only picking up or returning the call if it passes that baseline or feels genuinely urgent.

This necessary caution created an ironic dilemma two years ago during a business trip. On the third attempt, I finally answered an unknown number; the caller claimed to be from the tax agency regarding a filing issue. Because I couldn't recognise the number, I refused to cooperate until she could verify her affiliation with the tax agency. Unable to do so on the spot, she promised to send a letter on the agency’s official letterhead about the matter. It turned out it really was the tax agency, and the letter specified a call time, and because my frequent travel keeps me away for extended periods, I missed the window entirely by the time the physical mail caught up with me.

While I often wonder if my daily immersion in the identity sector makes me hyper-cautious, that doubt vanished last year when a close friend lost her life savings to a scam call impersonating the FBI. Her experience brought the true stakes into stark focus: when consumers are caught off guard or forced to guess who is on the other end of the line, the cost is a devastating collapse of trust. That is why, following my previous pieces on the foundations of decentralised identity and its application in KYC, I am collaborating with fellow expert Eric Drury to focus on business identity. Eric has been working hand-in-hand with the telecom industry and global bodies like the GSMA to leverage emerging identity standards and reshape network trust. Together, we are exploring how the industry is finally fighting back against this epidemic of fraudulent calls.

The asymmetry of trust and its multibillion-dollar price tag

It is increasingly obvious that our identities as customers are being checked more frequently and rigorously than ever before. For example, my bank recently introduced online identity verification tools even for a standard, in-branch bank card password reset. Yet, despite this stringent security on the consumer side, it remains nearly impossible for me to verify whether a caller claiming to be from the bank is legitimate.

This dynamic illustrates what Eric calls the ‘mutual authentication gap’, a flawed paradigm where consumers are routinely required to authenticate themselves to an incoming caller, while the caller remains structurally incapable of doing the same. The systemic failure persists partly due to privacy frameworks like GDPR, but primarily because legacy telecommunication networks lack a native, built-in cryptographic method to verify a call’s true origin.

Underscoring this urgency, imposter scams ranked at the top of the US Federal Trade Commission’s fraud categories for the fifth consecutive year, representing a staggering collective loss of USD 3.5 billion. With advanced AI lowering the operational cost of these scams to nearly zero, implementing mutual trust reciprocity is now an absolute imperative. This article explores how the breakthrough of ‘Branded Calling’ is addressing this crisis, fundamentally transforming how organisations secure communications with each other and their consumers.

What is Branded Calling, and why is it needed?

Branded Calling is an innovation that allows verified enterprises to display rich identity information, such as the company name, logo, and a reason for calling, directly on a customer’s screen. It addresses two separate but intertwined vulnerabilities: spoofing and the ‘unknown number’ problem.

Historically, Caller ID was designed as a passive, insecure feature. It merely displays the number or name attached to a line by relying on carrier database lookups and carries no inherent security. This structural gap is continuously exploited through ‘spoofing’, where bad actors manipulate call signalling metadata to force a consumer’s device into displaying a fraudulent call as though it originates from a trusted source, such as a bank or a government agency.

In the US, the industry's main defence against this has been STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted Information Using toKENs) frameworks. These protocols use digital certificates which allow an originating carrier to cryptographically attest to its confidence that the caller is authorised to use the number. Downstream carriers can then verify the certificate to ensure the call signalling hasn't been tampered with in transit. Critically, however, STIR/SHAKEN only authenticates the number and the integrity of the signalling chain; it does not authenticate the actual legal entity or organisation placing the call.

This architectural limitation exposes a second, distinct problem: even a fully legitimate, un-spoofed call still shows up as an unrecognised string of digits. Consumers can't distinguish a genuine business calling from an unfamiliar number from a scam call, so they default to not answering. This is the ecosystem gap Branded Calling is meant to fill, layering verified organisational identity on top of the call so reputable businesses can reach customers.

The carrier bottleneck: why trust demands a decentralised model

Identity is always an ecosystem play. Unfortunately, today's global telecom landscape remains heavily fragmented: protocols like STIR/SHAKEN lack universal adoption, and proprietary Branded Calling solutions don’t yet span the globe. This lack of uniformity stifles the cross-network and cross-border collaboration required to defeat modern fraud. The public telephone network’s legacy architecture prevents an originating carrier from securely transmitting caller data to the terminating carrier, even if business identity vetting occurred at the source. This structural limitation leaves the industry without a reliable or standardised mechanism to deliver trustworthy caller information to the recipient's edge device at a network level, and across jurisdictions. To overcome these hurdles and allow vetted corporate identity and brand assets to flow seamlessly, the industry must pivot toward a decentralised infrastructure anchored in open, industry-wide standards.

This is where the three-party Issuer-Holder-Verifier model, the decentralised identity paradigm discussed in my previous article, becomes a gamechanger. Crucially, this decentralised approach requires neither a centralised lookup database nor direct system-to-system integrations between disparate carriers. Instead, an enterprise is issued with a set of standards-based verifiable credentials containing vetted corporate metadata, authentic brand assets, such as an official company logo, and the cryptographic right to use a specific phone number. By using open standards, these digital credentials can travel securely along with the call across networks to the terminating carrier. Acting as the verifier, the terminating carrier cryptographically validates the organisation's identity before routing the call to its destination. By displaying authenticated brand information right on the screen at the moment of impact, this approach restores confidence, empowering consumers to know exactly who is calling before they answer.

Tim French, a 30-year telecom veteran and CTO of Rich Connexions, perfectly summarises why this collaborative framework fits the complex reality of global networks:

'Fragmented, proprietary solutions have historically failed to scale or apply measures consistently, serving only to further erode user confidence and hinder cross-network connectivity. Shifting to an evidence- and open-standard-based framework allows us to identify good traffic with certainty. Developing this decentralised blueprint means carrier networks can instantly route verified caller data directly to consumer devices, moving voice security from an unvetted guess to vetted identity secured by cryptographic certainty.’

An Open Verifiable Communications ecosystem is taking shape

Having worked briefly on a Branded Calling project back in 2022, I experienced firsthand the immense complexity of the global telecom ecosystem. This background made the breakthroughs unveiled at the 2026 Mobile World Congress (MWC) particularly exciting: the GSMA stepped forward to officially debut a live demo of the Open Verifiable Communications (OVC) project, backed by an impressive roster of sizable ecosystem partners.

The OVC project, built on the decentralised identity model, is an industry initiative designed to combat the rampant epidemic of fraudulent, spoofed, and consumer-targeted scam calls that have severely eroded trust in voice communications, crippling legitimate business outreach and the vital outcomes it is meant to achieve. To bridge the existing trust gap, it introduces critical governance and technical innovations. Architecturally, it establishes a structured, layered approach extending from a governance authority to localised vetting agents, ensuring the real-world identity of any business controlling a phone number is thoroughly validated. This governance model is reinforced by robust cryptographic protection for caller data, ultimately empowering consumer devices to securely display verified identities, such as official business names and corporate logos, directly to the user at the moment of impact.

This emerging ecosystem is actively taking shape by leveraging open standards to guarantee interoperability across diverse carriers and shifting geopolitical borders. By utilising verifiable credentials, OVC enables a secure, standardised ‘digital handshake’ that shifts the source of truth directly to the end-user’s device, rendering call validation instantaneous and significantly more secure than legacy system integrations. Officially debuted as a live proof-of-concept demo at the 2026 MWC, the OVC project underscores the vital role of industry-wide collaboration in rebuilding consumer confidence, filtering out malicious network traffic, and helping telecom operators seamlessly meet their evolving regulatory compliance obligations. As the project progresses, financial services are positioned as the first wave of enterprise adopters to experiment with and benefit from these trust layers.

‘Technology alone doesn't create trust; verified business identity does. Drawing on our years of experience in business identity vetting and Branded Calling, Numeracle is proud to participate in this landmark Open Verifiable Communications project. By embedding verified entity data directly into network standards, OVC ensures that when a brand name or logo appears on a screen, it is backed by real-world accountability rather than guesswork’, notes Rebekah Johnson, Founder and CEO of Numeracle.

US-based company Numeracle was recently selected by the Secure Telephone Identity Governance Authority (STI-GA) to develop the global vetting framework for cross-border STIR/SHAKEN governance.

Challenges ahead: moving beyond the technology

Identity is ultimately a bridge spanning technology and policy. As credentialing standards mature, the actual technical work required to credential an organisation becomes the easier part of the equation.

The real hurdle lies within policy, governance, and business integration. The telecom industry is navigating the complex friction of integrating these new trust layers into highly fragmented legacy telecom systems without demanding insurmountable operational effort or disrupting essential daily services.

Achieving true global scale requires ecosystem stakeholders to unite around practical governance frameworks and business models that deliver strategic value to all participants. The technology is here; now, industry leaders must actively collaborate to shape the rules of engagement. Only then can we ensure that the transition toward a less intermediated, two-way trust world is both highly resilient and genuinely interoperable.

Note: The author would like to thank Eric Drury, without whose tremendous expertise and invaluable contributions this article would not have been possible.

Eric Drury: As founder & principal consultant at ForthCo.io, Eric works at the strategic, research, and implementation levels as an advisor to enterprises, governments, and industry bodies seeking to understand and benefit from emerging Web 3 and decentralised technologies, with a particular focus on digital identity and digital trust ecosystems. After 25+ years of international consulting and business development experience spanning multiple industries and continents, Eric’s work today includes telecom-related digital identity initiatives, National Digital ID programs, and standards work with the Trust over IP Foundation.

About the author

 

Lucy Yang is an independent identity ecosystem expert, pioneering the global adoption of standards-based credentials. She specialises in navigating complex ecosystems, synchronising high-level policy and technical standards with large-scale implementation for governments and multinational organisations. Lucy is dedicated to deploying technology that solves real-world challenges, overcoming intricate market hurdles to shape secure, interoperable ecosystems on a global scale. You can learn more about her work at https://www.techservesapurpose.com/.