Better control is required over modified SMS alphanumeric sender IDs

Printer-friendly versionPDF version

Dr Pieter Streicher, MD of BulkSMS.com calls for sms providers and cellular networks to better control the use of alphanumeric sender IDs.

SMS technology allows for SMS messages to be sent from a modified alphanumeric sender ID. For example, SARS could send an SMS message to you, with the word SARS appearing at the top of the message instead of a numeric cellphone number.

The main benefit of alphanumeric sender ID is that it makes it much easier for consumers to recognize the sender.

However, this feature could be abused when messages are sent with a spoofed sender ID.

For example, SAPS recently sent the following message to almost all MTN subscribers:
origin address: SAPS
message: SAPS urges SA citizens to voluntarily hand in all illegal firearms before 11 April. For more info call National Firearms Call Centre 012 353 6111
Criminals could quite easily send the same message, with SAPS as sender, but replace the contact number with their own (the NF Call Centre number does not work anyway), and in this way collect a number of illegal firearms.

It is worth investigating to what extent sender IDs are controlled locally and globally? There are currently a multitude of international SMS messaging providers globally that offer sender ID modification, with various levels of control. Mobile operators also have various levels of control.

For example, in South Africa, Vodacom blocks all international SMS traffic with a modified alpha sender ID. It has recently offered sender ID control to Vodacom Wireless Application Service providers (WASPs), which requires the registration of each sender ID used. Consumers on the Vodacom network can rest assured that a message that says it comes from SARS, actually does come from SARS, and was sent via a registered Vodacom WASP and a member of WASPA.

Unfortunately at this stage, those not on the Vodacom network cannot trust the sender ID appearing on their phone at all. A message that says it comes from SARS or SAPS, could in fact be a phishing attack or an advance fee fraud scheme. The message could originate from a foreign fraud syndicate, using a network based in another foreign country, bypassing the SMS Messaging Centre of your home network, and bypassing WASPA regulations.

If proper controls are embraced by the industry as a whole, alphanumeric sender IDs could be a very effective safeguard against a number of SMS scams, by allowing consumers to easily recognize the sender, without the possibility of spoofing.