SMS ID registry loopholes plugged; service providers take steps to prevent spoofing

Singapore

LOOPHOLES in the Singapore SMS registry appear to have been closed.

The Singapore SMS sender ID protection registry was meant to stop anyone from impersonating a company via SMS if the company was registered.

Checks by The Business Times last week found that at least one of the means of eluding the registry no longer works, possibly because message aggregators have tightened their processes.

The registry was supposed to prevent scammers from sending messages that appeared to come from legitimate sources such as banks, government agencies and other service providers.

Previously, BT had reported that companies and organisations on the registry could still be spoofed using SMS aggregators online. But SMSes sent with registered sender IDs using those same aggregators will now fail.

SMS vendors and Tier 1 SMS aggregators BT spoke to said there are several measures that can be implemented to stop scammers from spoofing sender IDs.

SMS vendors work with Tier 1 SMS aggregators to send messages on behalf of companies, while Tier 1 SMS aggregators work directly with telcos to send messages to consumers.

Mark You, founder of software development company Ann Consulting, said that 10 years ago, approval for the use of sender IDs used to be automated. But after his company noticed the potential for misuse on its ReplyX platform, it began to manually approve sender IDs.

"In the past, people would use 'CID', 'MOH'... anything that is within 11 characters, they would have been able to use," he said.

The company now conducts checks to ensure only legitimate businesses are allowed to register sender IDs for brands they own.

Brandon Teo, chief executive of Pacific Synergy, which runs the aggregator Commzgate, said the company has never allowed unverified businesses to send SMSes with sender IDs.

Some of the information that the company checks for include business registration numbers and company letterheads. It also does not register names that look too similar to existing businesses, such as "DB5".

Maven Labs business director and founder Hiew Wee Soon said his company, which is also an SMS aggregator, also conducts checks on businesses that wish to send SMSes with sender IDs. If they claim to be from regulated industries such as moneylending, the company will also ask to verify their licences.

But Teo of Pacific Synergy said there will still be overseas vendors and aggregators that do not put in as much effort to verify their customers.

"There's money to be made; Scammers are spending the money with providers like us. It's hard for businesses, with sales targets to meet, to turn away business," he said, adding that licensed local providers will still need to do their due diligence.

Teo also said many of his current clients would likely not be able to afford the high cost of registering for Singapore's SMS sender ID registry. Some of these clients only spend about S$500 to send SMSes for the entire year.

BT understands that charges of between £15,000 (S$27,439) and £22,000 have been levied on companies here.

The global trade body Mobile Ecosystem Forum (MEF), which manages Singapore's SMS sender ID registry, said its maximum charge per enterprise was less than S$50,000 per year.

The not-for-profit organisation also said the cost of registering depends on the support and coaching companies require, the size of the business, the commercial or not-for-profit nature of the business and the number of brands and sender IDs that are protected.

The charges go towards the management of the registry; coaching and training for companies, including monthly or weekly calls with a team of cyber threat analysts; and the running of the industry forum to share intelligence about fraud and coordinate actions across stakeholders.

"The solution is supposed to protect the most vulnerable enterprises, and not for everyone," an MEF spokesperson said.

The registry is currently also being used in the United Kingdom and Ireland. As of 2021, the registry has protected over 70 bank and government brands. More than 24 banks and government agencies directly participate in the registry and 352 sender IDs have been registered to date.

Hiew noted that Indonesia and the Philippines require telcos to verify and whitelist companies and their aggregators to secure the messages that are sent.

In such a system, companies register their sender IDs and the aggregators that they authorise to send SMSes with individual telcos. Unregistered sender IDs are blocked by default within these telcos' networks. Hiew said registration is usually done for free or at a much smaller one-time fee than what the MEF charges.

Minister for Communications and Information Josephine Teo, in her ministerial statement to Parliament on Feb 15, said the Infocomm Media Development Authority (IMDA) is studying the possibility of making the SMS sender ID registry mandatory as scammers can still use similar-looking sender IDs to trick potential victims.

"These further measures will take time to implement and come at a cost, including to businesses.

"Businesses that choose not to register alphanumeric IDs will have their SMS messages appear only with their telephone number. Their customers can then choose to save the number in their own contact list to help them recognise future messages." she said.