Updates: Check the release notes for new features and product updates.

How Verified Calls works

Verified Calls lets you verify and brand calls that you make to users. With minimal processing on your infrastructure, you can enhance your calls with users, build user trust, and prevent scams.

Getting verified

Before you make calls with Verified Calls, you need to create an agent, which controls how calls from a brand appear to users.

A Verified Call with branding information

The life of a verified call

When you make a call with Verified Calls, your Verified Calls agent registers the call (including caller and recipient phone numbers) and call reason. Verified Calls pushes your registered call to the recipient's device, the device fetches your branding information, and Verified calls returns a 200 OK HTTP response with an empty body ({}).

Sequence diagram of registering a call

Once Verified Calls returns a 200 OK, you're ready to place the call. When you place the call via your normal means, your agent needs to update the call state so that Verified Calls knows when the call is ringing or busy, which is compared to the current state of the Phone app and used for fraud detection. Once the call state matches, your agent information and call reason display on the recipient's call screen.

Sequence diagram of placing a call and updating the call state

When the call connects, your agent sends another update. This keeps the call information registered with Verified Calls up to date with the state of the call in the Phone app and confirms that the current call is valid.

Sequence diagram of updating the call state

When the call completes, your agent sends another update.

Sequence diagram of updating the call state

When you want to place another call, the process repeats: your Verified Calls agent registers the call information, you place the call via normal means, and your agent sends call state updates to Verified Calls to track the progress of the call.

Handling fake calls

While bad actors can spoof phone numbers when placing calls, Verified Calls's mitigation strategies make spoofing a call difficult, expensive, time-sensitive, and short-lived.

Call registration

Registering calls is Verified Calls's initial and primary deterrent against fraudulent calls. When an agent registers a call, the call screen on the recipient's device displays agent branding information and a call reason. If a call isn't registered, the call screen displays as it would for any call, relying on the recipient's contact information.

If a bad actor places a call with a spoofed number, the call isn't registered, so the call displays as it would without Verified Calls. If a bad actor happens to time a call immediately after an agent registers a call but before the agent places the call, Verified Calls detects and stops fake calls with call state matching.

Call state matching (optional)

To detect fake calls, the Phone app compares the state of the current call with the state of the call stored by Verified Calls. If there's a discrepancy between the current call state and registered call state after a reasonable amount of time, the Phone app determines that a call is fake, disconnects the call, and notifies the user.

For example, if a bad actor places a call after you register a call but before you initiate the call to the recipient, the call state in the Phone app is RINGING, but the call state stored by Verified Calls hasn't been updated and so is UNSPECIFIED. If after a reasonable amount of time the call state stored by Verified Calls isn't updated to RINGING—or if the recipient accepts the call, to CONNECTED—the Phone app determines that the call is fake, disconnects the call, and displays a "Fake call detected" message to the user.

When you place a call and indicate that a call is CONNECTED, no additional calls can use that call's verification or information. If a bad actor attempts to place a call with a spoofed number after you update a call state to CONNECTED, the Phone app sends a busy signal to the fake call and displays a "Fake call detected" message to the user.

Encryption

Communications with Verified Calls are encrypted between Verified Calls agents and Google and between Google and users' devices.

Next steps

Before you begin placing verified calls,

Once you've done that, you're ready to place a verified call.

Please refer to STIR Out-of-Band Architecture and Use Cases for relevant industrial discussions.