Phishing attempts: Trai’s move to curb fraud could lead to SMS service disruption next month

Consumers You may experience interruptions in obtaining service and transactions. messages of banksfinancial institutions and e-commerce companies on their mobile phones from next month following a move by the telecoms regulator aimed at curbing spamspecifically phishing attempts.

He Telecom Regulatory Authority of India (Trai) has asked telecommunications companies stop transmitting messages containing URLs, OTT links, APKs (Android application packages), or callback numbers that are not whitelisted (or registered with telecom companies) by senders starting September 1.

The regulator’s ultimatum means that banks, financial institutions and online platforms must register their templates and content with operators by the August 31 deadline, otherwise messages containing these elements will be blocked.

Currently, entities get their headers and templates registered with telecom companies, but not the content of the messages. This means that operators do not perform debugging or verification tasks on the content of transmitted messages. But starting next month, telecom companies must create a mechanism that can read the content of messages. commercial messagesand block those that don’t match their records, experts say.

In India, between 1.5 and 1.7 billion commercial messages are sent every day, bringing the total to about 55 billion each month, according to industry data.

Industry executives say the telecom sector is currently asking Trai for more time to implement the mandate as the blockchain-based distributed ledger technology (DLT) platform needs to be upgraded.

Possible repeat in March 2021
But the regulator believes it has given telecoms companies enough time and is not willing to budge, officials familiar with the matter say.

Bharti Airtel, Jio Dependency and Vodafone Idea did not respond to ET’s queries.

Whitelisting means that entities sending messages must provide all information related to URLs, callback numbers, etc. to telecom companies, which will then send the information to their DLT platform. If the information matches, the message is transmitted; otherwise, it is blocked.

For example, most bank transactional messages, such as debit or credit of funds, contain a number that can be called. Transmission of such messages will stop if the bank does not whitelist the number.

“Only those entities, including banks, that whitelist their URLs or the content of messages with telecom companies will be allowed through; the rest will be blocked,” said a telecom industry executive.

The regulator’s intention is to ensure that all commercial messages are vetted before they reach the consumer as part of a broader effort aimed at combating widespread spam and fraud perpetrated through messaging or phishing. However, the immediate and unintended consequence could be disruption for the end consumer, who may face difficulties in receiving even relevant and important financial or transactional messages, industry observers say.

Mobile consumers faced a similar disruption in March 2021, when the DLT platform was rolled out and telcos started scrubbing messages. At that time, there was widespread disruption, as telcos blocked all commercial messages that did not contain whitelisted headers and templates. Following the disruption, all entities have registered their headers and templates with telcos.

Experts say that in the current scenario, an increasing number of messages may move to over-the-top (OTT) platforms like WhatsApp and Google’s rich messaging services (RCS) as there is no mandate from Trai to govern them.

However, banking messages, whose rules do not allow transmission via OTT, will be blocked if the entities have not been whitelisted, the experts added.

While Trai has been asking telecom companies to implement the latest measures for over a year, limited compliance prompted the regulator last week to clamp down and ask telecom companies to stop transmitting non-whitelisted messages from September 1.

In May last year, Trai had issued instructions asking telcos to ensure that only whitelisted URLs, APKs, OTT links and callback numbers were present in the content template and asked for a compliance report within 45 days. In the instructions, the regulator had asked telcos to always ensure traceability of messages from senders to recipients. But telcos have not implemented the instructions in full till date.