smsmode© fights against smishing

What is smishing?

Smshing, smishing or SMS phishing is a phishing technique using SMS. It is a scam that works like email phishing, but from a phone number. A cybercriminal tries to get personal or banking information or money directly from the recipient of an SMS message, using the identity of a brand or government service (bank, parcel delivery, CPAM, Ameli or any other well-known brand).

In 95% of cases, this fraudulent SMS contains a URL that redirects victims to a website that looks as similar as possible to the one of the organization that is supposed to be the sender, in order to inspire confidence. The victim is then asked to enter his or her banking information in order to withdraw a sum of money, sometimes on a recurring basis.

In other SMS phishing attempts, the fraud consists of offering to download an application "update", which is actually a copy of a trusted application, acting as a spyware on the phone.

In some rare, but increasingly common, cases, scammers invite you to call a number so that an accomplice on the other end of the line can obtain your information.

Scammers work hard to get the victim to take action, the supposed sender of the fraud is always a very serious company or a critical service, and by creating a sense of urgency in the victim.

Examples of smishing:

SMS phishing on the rise:

Since the beginning of the year, French mobile subscribers have been subjected to numerous smishing attacks. Operators and the AF2M (French Association for the Development of Multi-operator Multimedia Uses) have noticed an explosion of frauds. At the top of the list: CPF scams, social fraud, under the name of Ameli or CPAM, banks, Amazon or Chronospost delivery which would need a postage...

The trend has really increased in the last few months, to the point that French operators and aggregators, in consultation with the AF2M, have decided to implement new rules regarding the sending of Push SMS (A2P).

The new rules implemented by the operators :

All stakeholders (French operators, AF2M, A2C*, aggregators...) have agreed to change the rules for sending SMS messages, in order to protect the identity of "sensitive" brands that may be used and to guarantee more security for mobile users.

The main measure of this commission is the limitation of the use of OADC (Sender ID), otherwise known as personalized senders. All senders of so-called sensitive brands, or resembling a sensitive brand, are prohibited, a priori.

In the same way, too generic Sender IDs like "SMS Info" are forbidden.

To ensure the implementation of these measures, SMS aggregators, led by smsmode©, have implemented a series of filters and an artificial intelligence system to whitelist or blacklist OADCs.

* Association of Independent CPaaS and CCaaS Actors

What about Sender Ids for real "sensitive" brands?

It is obvious that "sensitive" brands retain the right to use their name and its variations as a personalized transmitter. To ensure this in complete security, each aggregator is asked to provide operators with the list of permitted issuers, as they belong to the brands they represent. This authorization takes the form of a letter/form, addressed to the operators and signed by both parties, giving the subcontractor the authorization to use the Sender ID(s) of the brand concerned.

Once unlocked, the brand's outsourced platform can route the messages without the SMS being stopped by anti-spam filters.

What changes for you, our customers:

Sender ID changes:

Rest assured, the personalized sender is still part of the features offered by smsmode©.

To continue using your Sender ID, the first step is to have your account/organization validated by our services. You can then provide us with the list of Sender IDs you wish to use for your SMS campaigns.

If you have an organization (a parent account with multiple sub-accounts) and you pass the validation process, all your sub-accounts will be automatically validated.

Once your account is validated, you will be able to use the Sender IDs of your list. If however you send a message with an unknown sender, not included in your list of predefined senders, the message will not be sent and will be in error (visible on your space).

If your account is not validated, you will not be able to customize your Sender ID. If you attempt to do so, your sender will be overwritten and replaced by the default OADC (a shortcode in most cases).

This new mechanism has been added to all our services.

FOR A COMPLETE SUPPORT...
Our subscription packages
DOWNLOAD

Changes related to URLs:

In order to continue to integrate URLS into your campaigns, we invite you to let us know which legitimate URLs you wish to send in France by sending your list to support@smsmode.com.

All messages containing unverified URLs will be blocked by our platform.

Will these new rules be enough to stop smishing?

These safeguards are useful to protect the A2P market, as they are able to guarantee that no fraud or scam is going through a serious aggregator like smsmode©.

On the other hand, most of the smsishing traffic goes through grey or low-cost routes (via classic SIM cards) where the SMS is sent by a 06 or 07 number, without Sender ID. This type of filtering is therefore not possible.

According to AF2M 98% of smishing attempts reported to 33 700 come from illegal routes (grey route or SIM farm).

On this subject, the ball is in the court of the operators, who must fight against these illegal routes that serve the market. Of course, smsmode© does not use any grey routes.

However, a solution to this problem has already been found by the operators. The dialogue between brands and customers will in the future only take place on numbers starting with 09. A radical solution that should make it possible to draw a definitive line on smishing.

Conclusion:

These measures may seem restrictive, but they are truly necessary to (re)build trust within the A2P SMS. Choosing a partner who is committed to fighting fraud, who is directly connected to operators and who does not use any grey routes, is becoming more and more important. The SMS Push market is also moving towards more and more controls on the URLs used to limit the performance of these fraudulent marketing campaigns, so it seems imperative to turn to a partner that allows you to control the senders and be in good standing.