Mandate a way for me to say whether incoming calls were spam. Require my phone company to pay me money every time I get spammed. Allow my phone company to, at their option, proactively block calls from specific upstreams and/or pass the charge to the specific upstreams.
Now from those incentives, the fines will naturally follow the upstreams to the source of the spam, and provide motivation for them to clean their acts up. Voila! (And if telephone companies decide that they need a more secure protocol to make spamming harder, that's up to them.)