A call that shows a company name, logo, or authentication badge on screen is more trustworthy than a call whose displayed number may have been forged, but that does not automatically make every request made during the conversation safe. Call authentication is designed to validate the technical origin of a call and reduce spoofing — falsifying the number shown to the recipient. It does not analyze what is said on the phone, confirm that every instruction from the caller is legitimate, or replace basic precautions when someone asks for a password, code, payment, or remote access.
Short answer: the badge proves origin, not the content of the conversation
According to Anatel, authentication validates the calling number; identification shows the recipient information such as caller name, number, authentication badge, logo, and reason for the call, depending on the device and the data supplied by the originating party. The technology uses STIR/SHAKEN for authentication and RCD (Rich Call Data) for enriched identification data.
The most important limit is built into the system itself: Anatel says it works with signaling data and does not access the content of the communication. The practical consequence is straightforward: a badge can show that the network validated the origin/number, but it does not certify every statement, offer, collection request, or instruction given during the call as true or safe.
What the badge proves — and what it does not prove
| The badge/authentication helps prove | The badge does not prove by itself |
|---|---|
| That the displayed number was validated as the origin of the call. | That every request made during the conversation should be followed. |
| That the call went through the technical authentication process in the networks involved. | That you should disclose a password, SMS/OTP code, Pix key, or banking information. |
| That, when available, the name, logo, and reason for the call were associated with the caller in the identification ecosystem. | That the content of the conversation was audited or approved by Anatel, the carrier, or the phone manufacturer. |
| That scams based only on forging the displayed number (spoofing) become harder. | That abuse, fraud, or social engineering is impossible if someone is misusing an authenticated origin. |
| That the consumer has more context to decide whether to answer and how to proceed. | That a call without a badge is automatically fraudulent. |
Authentication and identification are different things
The distinction helps you interpret what appears on the screen:
- Authentication: the technical validation of the caller identity and originating number. Its purpose is to prevent or make it harder for a fraudster to make a call look as if it came from another number.
- Identification: the visual layer shown to the recipient, with information such as name, number, badge, logo, and call purpose.
In the Brazilian model, STIR (Secure Telephone Identity Revisited) authenticates identity, SHAKEN standardizes how that authentication is used across networks, and RCD carries additional information such as brand and reason for the call. The commercial service known as Origem Verificada combines these capabilities for participating companies.
What appears on the phone depends on the device
The experience is not identical on every smartphone. Anatel's technical page, updated in 2026, says display depends on a compatible device, 4G or 5G network, VoLTE enabled, a compatible operating system, and support from the voice network.
| Device type | Requirements listed by Anatel | What may appear |
|---|---|---|
| Samsung with Android 14 or later | 4G-or-later smartphone, Android 14+, VoLTE enabled on device and carrier | Name, number, badge; logo and reason may appear when supplied |
| iPhone | 4G-or-later iPhone, iOS 18.2+, VoLTE enabled on device and carrier | Name, number, and logo when available; the authentication badge is shown in call history |
| Samsung with Android 10 to 13 | 4G-or-later smartphone and VoLTE enabled | Name, number, and authentication badge |
| Other manufacturers with Android 11 or later | 4G-or-later smartphone, Android 11+, and VoLTE enabled | Name, number, and authentication badge |
| 2G/3G or unsupported devices | Without the technical requirements of the solution | The call still arrives normally but may show only the number |
This explains why two people can receive the same legitimate call and see different information. It also explains why the absence of a logo or badge on the main incoming-call screen should not be used, by itself, as a diagnosis of fraud.
An authenticated call can still require caution
Authentication reduces an important class of fraud — spoofing — but it does not eliminate social engineering. Anatel's own governance model includes exclusion rules and certificate revocation in cases of abuse or fraud, which shows that authenticating an origin is not the same as declaring every action by the caller legitimate.
And because the system does not listen to or validate the conversation, the recipient still has to assess the nature of the request. A call deserves additional verification, even with a name or badge on screen, if the caller asks for:
- a password, PIN, SMS code, or OTP;
- banking information or login credentials;
- a Pix payment, bill payment, transfer, or immediate payment under pressure;
- installation of an app, screen sharing, or remote access to a phone/computer;
- personal information that should not be necessary for that contact;
- urgent action combined with threats, secrecy, fear of account blocking, or financial loss.
In its fraud-prevention guidance, Anatel recommends being suspicious of calls that ask for personal data, passwords, banking information, or payments and, when in doubt, ending the call and confirming the matter through the institution's official channels. The same page describes fake call-center scams in which criminals try to persuade victims to disclose data or grant access to a device.
What to do when a call looks legitimate but the request is sensitive
- Use the badge as evidence supporting the origin, not as automatic authorization. Check the name, number, and, when shown, the stated reason for the call.
- Compare the request with your real relationship with the company. An unexpected collection, unusual profile change, or request for credentials deserves independent confirmation.
- Do not disclose authentication secrets. Passwords, OTPs, and confirmation codes exist precisely to prove that you are authorizing an action.
- If money, account access, or profile changes are involved, end the call. Open the official app, type the website address yourself, or use the phone number published on your card, contract, or official channel.
- Confirm through a second channel. The goal is not to rely on the same call that is asking you to act.
- If you suspect misuse of authentication, report it. Anatel says reports can be filed through the AIA/Origem Verificada portal and, if necessary, through Anatel's own channels.
Does a call without a badge mean fraud?
Not necessarily. Anatel says adoption of enriched identification is gradual and legitimate calls may still arrive without those visual elements. This can happen because a company has not contracted the solution, because some part of the network does not deliver enriched data, or because the recipient's device does not meet the requirements.
So the correct reasoning is neither “no badge = scam” nor “badge = completely safe.” The badge is meaningful technical information that improves origin traceability; deciding whether to trust a request made during the conversation still depends on context.
What is the status of call authentication in 2026?
As of September 2026, Brazil is in a progressive rollout. Origem Verificada is commercially available to participating companies, while regulatory rules are expanding call authentication. Since November 1, 2025, users classified by Anatel as large callers — those originating more than 500,000 calls per month per carrier — have been subject to authentication of all calls under the implementation decision published by the agency.
At the same time, the General Telecommunications Services Regulation approved by Resolution No. 777/2025 provides for mandatory implementation of authentication by carriers within up to three years. Anatel also maintains specific anti-spoofing and traceability measures, updated in 2026.
A practical rule: do not confuse “validated origin” with “validated request”
Read the badge this way: “the network validated who/which number is originating this call.” Do not read it as: “the network guarantees that everything requested in this conversation is safe.”
That distinction preserves the real benefit of the technology — reducing number spoofing and giving consumers more context — without creating a false sense of invulnerability. For sensitive requests, the strongest protection is still to combine call authentication with independent verification through an official channel.
