Cyber Defense eMagazine January Edition for 2022

Know your customer
As spam and phishing messages are on the rise messaging service providers need to ensure more than
ever that its business customers are complying to rules and regulations. This includes communicating
compliance rules to brands, ensuring the legitimacy of businesses, understanding the use cases and go
through proper approval processes for new service offerings.
These compliance efforts have been underway for several years now in the US when it comes to Short
Code services (5-or 6-digit numbers that are used for sending messages). This year mobile operators
have launched additional compliance requirements for message traffic that is sent on long numbers
(standard 10-digit phone numbers). Those type of message traffic has been flowing largely unregulated
in the US for the last 10 years and has been subjected to spamming and phishing attacks by bad actors.
Not anymore, as now every entity who seeks to send SMS text traffic in the US is required to register its
brand and campaign before being able to obtain a long number and send message traffic. The new
regulatory regime is called 10DLC (10 Digit long code). It is the responsibility of SMS providers like
Clickatell to enforce those rules and make sure its customers are fully compliant.
Similar to how compliance is managed in the SMS world messaging service providers as well as the
large chat app providers such as WhatsApp or Apple are also enforcing strict registration and verification
rules. Messaging service provider are required to help qualify and register campaigns and services for
its business customers on channels such as WhatsApp or Apple. In addition, they provide end to end
service security via message encryption and manage authentication, verification and other security
related services for its business customers.
Spotting a Fraudulent Text Message
The first step in identifying a fraudulent message is understanding the different types of phone numbers
used to deploy messages. Most legitimate text messages are sent via short code numbers that contain
5-6 digits and are primarily used only by large enterprise companies due to high costs. As mentioned,
short code numbers have been strictly regulated for many years making it extremely rare to receive
a spam text or phishing attack from a short code number.
On the other hand, if you receive a message from a normal 10-digit phone number claiming to be your
bank, network provider, or retailer you’ve engaged with, you need to be cautious. The message could
still come from a non-compliant long number that was obtained before the introduction of stringent
registration requirements allowing only established brands to send messages via 10DLC regulation. If
the message is coming from an 1800 number, it will have also have gone through a verification process
and can be considered relatively safe.
Cyber Defense eMagazine – January 2022 Edition 57
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.