Businesses wanting to send SMS messages using custom ‘sender ID’ labels will have to register them first, ACMA has announced in calling for feedback on proposed anti-scam rules that will force telcos to block all non-compliant messages from 15 December.
The evolving SMS ID Register, which will be mandatory for telcos when implemented, was legislated last year as part of the government’s Fighting Scams initiative and will be governed by the Telecommunications (SMS Sender ID Register) Industry Standard.
It is designed to stop scammers from tricking mobile users by co-opting the legitimate sender IDs of organisations like the NAB, ASIC or ATO, making their spam SMSes seem trustworthy by tricking mobiles into grouping them alongside legitimate messages.
Pilot testing of the scheme – which requires registered sender IDs to be linked to a single participating telco, then blocks any SMS messages sent using the same sender ID but from a different telco – fed an April consultation on its proposed rules.
International entities and Australian non-business entities will register their preferred sender IDs directly with telcos certified by the ACMA, with unapproved telcos blocked from transmitting SMS or MMS messages with sender IDs.
Messages with unregistered sender IDs will be overstamped with the word ‘Unverified’ – meaning that users will see all messages from unregistered senders grouped into a single ‘Unverified’ thread of messages that should be approached with caution.
Those rules “will directly affect how telcos and message service providers operate,” ACMA chair Nerida O’Loughlin said, labelling the evolving rules as “a call to action for all organisations who use sender IDs including banks, retailers, utilities, and NFPs.”
“You need to start preparing now to be able to continue to use this method to contact your customers” after use of the SMS ID Register becomes mandatory in December, she added.
Blocking one of scammers’ favourite tricks
The SMS ID Register is aimed at blocking scammers’ popular spoofing of sender IDs, which is a major element of a scams environment that last year saw Australians report 77,365 text message scams that stole $14 million.
This year alone, ScamWatch has received 11,774 reports of text message scams, with $9.5 million in reported losses – corroborating reports that scammers are becoming more effective at extracting larger amounts of money from fewer victims.
The scams are a worldwide problem, with one recent North Carolina State University study collecting the scam SMS messages sent to 2011 virtual phone numbers, which received nearly 68,000 phishing messages over 13 months.
Analysis identified 600 distinct SMS phishing operations, with scammers using “the same infrastructure as everyone else,” lead researcher Alex Nahapetyan said in noting service bundles that showed SMS phishing was mirroring the “email phishing economy.”
Capitalising on a ‘critical opportunity’ to stem losses
Proactively blocking messages from unregistered senders will help telcos apply similar rigour to SMS scams as the Brand Indicators for Message Identification (BIMI) standard has done for emails, with Google adding blue ticks to help identify unverified senders.
Experience has shown sender ID filters are effective, with Singapore’s SMS Sender ID Registry cutting scams by 64 per cent and 87 per cent of consumers finding it easier to confirm messages’ legitimacy, ACCAN noted in its submission to the ACMA process.
Introducing a similar scheme in Australia “presents a critical opportunity for the law to disrupt scam business models and ensure Australian consumers are protected from harm,” the organisation said, flagging a likely “significant reduction” in losses.
A government impact analysis found that a mandatory scheme would save $257.7 million over 10 years, with registered sender ID users paying $127.3 million to deliver the scheme and industry and government chipping in $34.3 million.
The scheme is one of many anti-scam initiatives in play, with banks uniting to block scam payments, the National Anti-Scam Centre cracking down on scam job ads, and the AFP warning of crypto exchange scams co-opting celebrities’ identities.
ACMA is accepting feedback on the proposed changes through 13 August, with the scheme’s rules to be finalised by 30 September, telcos onboarded from 15 October, and entities required to register their preferred sender IDs with telcos from 30 November.
