Fighting SMS spam and scams

[rpm]

SMS scam and spam fight

Criminal activities such as phishing scams, spam and identity theft can usually be traced to foreign SMS gateways

[nicki]

Sounds more like a "scare them away from the others to use our services" rather than "lets sort out the mess"

[donaldza]

Agreed, some scare tactics by WASPA into using it's members, where they should be looking at the real problem, ie: Why is it cheaper to use offshore companies than it is to use the local operators?

[<moLe>]

oh wait and this way we get to choose our competitors how convenient

[krycor]

exactly what i'm thinking.. esp when overseas ones will be cheaper me htinks.

[Ant_Brooks]

Sounds more like a "scare them away from the others to use our services" rather than "lets sort out the mess"

Well, you can't have it both ways. If a WASPA member sends you SMS spam, you can lodge a complaint, make sure that you are removed from any spam database and if the relevant WASP is a repeat offender, they will probably be fined. (An archive of rulings against WASPA members for breaches of the WASPA Code -- including some fines for sending spam -- is available here.)

But WASPA only has jurisdiction over its members. So if you get spam from someone using an international gateway, you don't have any recourse and there's no guarantee that you can do anything at all to get your number removed from their database.

Basically, you can pick one of these two options:
1. Freely allow companies to use international SMS gateways to send messages and accept the fact that this means that you will get SMS spam that you can't do anything about.
2. Stop companies from using international SMS gateways to bypass local WASPs, with the result that consumers are better protected against SMS spam, because local WASPs get fined for allowing their customers to send spam.

Disclosure: I'm involved in team that deals with WASPA complaints, so I'm obviously biased on this issue. I do know that it is quite frustrating when the complaints team gets SMS spam complaints for messages that originate via an international gateway, and there's nothing we can do to stop that person getting spam.

[donaldza]

I understand the reason for WASPA to exist, but many legitimate businesses/people seek pricing for SMS and when they receive the prices they quickly decide to use offshore companies as they are up to 50% cheaper than WASPA members.

So as I said before, the pricing must be fixed to motivate people to use local carriers rather.

[cbrunsdonza]

I understand the reason for WASPA to exist, but many legitimate businesses/people seek pricing for SMS and when they receive the prices they quickly decide to use offshore companies as they are up to 50% cheaper than WASPA members.

So as I said before, the pricing must be fixed to motivate people to use local carriers rather.

One thing that you are forgetting is that WASPS offer a service*. If a company only wants to send MTs and is price sensitive then they should setup a kannel instance with a telemetric contract.

And pricing is rather "fixed" as you will find that the difference in bulk sms rates varies by fractions of a cent when dealing with bigger WASPS.

Other issues is that offshore companies are not allowed to own shortcodes or longcodes and this is important for some companies needs.

But getting back to the article: Vodacom no longer routes MTs that have been manipulated in anyway.

* I work for one of the largest WASPS and we have many big corps who use us as its cheaper than for them to manage their own infrastructure. Sometimes the cost of a MT through us is way less than just their original management fees per MT when they (the corps) managed it themselves (server hosting / admin / development)

[Lazy]

Vodacom no longer routes MTs that have been manipulated in anyway.

You mean on-network If the sms originates from an international carrier, (delivered through an international gateway) it will still be delivered.

This is an epic fail on the network's part as far as I am concerned. The network should:

- Allow customized originating address. For example, allow EDGARS to use EDGARS so long as it is registered to them. After all, Vodacom actively use 'VODACOM' (+ digit) on their own network (as an example)

- When receiving international traffic, do a lookup to determine if the mobile that 'supposedly' sent the message/made the call/established the session is registered locally, and if so, block the message. (IE it is currently on-net and is not expected to be sending messages coming from an international source). I say this because not only is it possible to manipulate the originating number, but the network will actually think that the message is legit if they spoof your phone's MSISDN. This applies not only to SMS, but also to phonecalls and USSD sessions.

That aside (and back on topic), WASPA does a good job. If you get SMS spammed check out SMS Code and take action from there...

[cbrunsdonza]

You mean on-network If the sms originates from an international carrier, (delivered through an international gateway) it will still be delivered.

This is an epic fail on the network's part as far as I am concerned. The network should:

- Allow customized originating address. For example, allow EDGARS to use EDGARS so long as it is registered to them. After all, Vodacom actively use 'VODACOM' (+ digit) on their own network (as an example)

- When receiving international traffic, do a lookup to determine if the mobile that 'supposedly' sent the message/made the call/established the session is registered locally, and if so, block the message. (IE it is currently on-net and is not expected to be sending messages coming from an international source). I say this because not only is it possible to manipulate the originating number, but the network will actually think that the message is legit if they spoof your phone's MSISDN. This applies not only to SMS, but also to phonecalls and USSD sessions.

That aside (and back on topic), WASPA does a good job. If you get SMS spammed check out SMS Code and take action from there...

Actually the only way you can manipulate an MT is using an international carrier or having a SS7 line which is near impossible - unless you work for a network

A lot of the international carrier originating MTs are manipulated in that the sender from is changed to either a name or a local number. Its this that is of concern to WASPA as it opens up the potential of fraud - imagine spamming your ex-girlfriend but changing the sender from to someones number you do not like.

[Lazy]

Actually the only way you can manipulate an MT is using an international carrier or having a SS7 line which is near impossible - unless you work for a network

Yup, but there are companies (with API's) which reside outside of our boundaries that you can use. Locally, using SMPP, forget it...

MTN used to give WASPS access to their international gateway so I'm not sure if that has changed. I vaguely remember the name MTN Airborn

The good news here is that the local carries protect their SS7 like gold. It therefore leaves international SS7, international API and SMPP as your options.

A lot of the international carrier originating MTs are manipulated in that the sender from is changed to either a name or a local number. Its this that is of concern to WASPA as it opens up the potential of fraud - imagine spamming your ex-girlfriend but changing the sender from to someones number you do not like.

Agreed. But, as with the SMPP spec's there's no reason why alphanumeric values can't be assigned to WASPS/organizations. If they assign the value to you, it essentially becomes like an MT Account, you have to bind on it to use it or bind on a link that has permission to use it.

If they do it that way, then the need for local organizations to seek out international carries is reduced to cost only (and not for the functionality as well)

Also, when the international message comes through using a local number, the network will bill that local number for the message. We've tested this on SMS and USSD before. That's why I say EPIC FAIL on the network's part.

EDIT: Tagging is also a form of MT account manipulation in my view.

[cbrunsdonza]

Yup, but there are companies (with API's) which reside outside of our boundaries that you can use. Locally, using SMPP, forget it...

MTN used to give WASPS access to their international gateway so I'm not sure if that has changed. I vaguely remember the name MTN Airborn

The good news here is that the local carries protect their SS7 like gold. It therefore leaves international SS7, international API and SMPP as your options.


Agreed. But, as with the SMPP spec's there's no reason why alphanumeric values can't be assigned to WASPS/organizations. If they assign the value to you, it essentially becomes like an MT Account, you have to bind on it to use it or bind on a link that has permission to use it.

If they do it that way, then the need for local organizations to seek out international carries is reduced to cost only (and not for the functionality as well)

Local networks are not prepared to budge on changing the sender from on a MT, but it ironic that Vodacom can do it for their own "information" MTs.

Also, when the international message comes through using a local number, the network will bill that local number for the message. We've tested this on SMS and USSD before. That's why I say EPIC FAIL on the network's part.

Very interesting. I know how to manipulate SS7 traffic to do this on the MO path, but agree 100% that its an epic fail to do this on the MT path.

EDIT: Tagging is also a form of MT account manipulation in my view.

Problem is not enough longcodes. Pity that VC & MTN don't follow CellCs example and use the shortcode in the longcode

ie: shortcode 12345 / longcode 27840012345

But tagging is useful for companies when they send out multiple messages that can each have their own reply path. Its not fun trying to code such a system if you don't have multiple longcodes or tagging enabled.