A MyBroadband reader recently contacted us to detail how his 3-year-old son was able to subscribe to a “R10-per-day” adult WASP service, despite the required double-opt-in barrier.
The reader said he recreated the scenario which led to his son subscribing to the service after he discovered over R600 in airtime was spent on a WASP’s adult subscription.
While his son was playing a free downloaded kid’s game on his wife’s Samsung smartphone, an advert appeared on the bottom of the screen. This happened while on an MTN cellular data connection.
Tapping on the advert opened the phone’s browser and a subscription page to an adult service was displayed.
Tapping on a red Click Here button – which a 3-year-old is likely to do to get back to the game – then leads to an opt-in message page, said the reader.
If you tap accept on the opt-in page, you are subscribed to the R9.99-per-day adult service and taken to a subscription page.
Fortunately, no adult content was shown on any of the pages, he said.
No SMS or USSD string
The reader said that what surprised him was the lack of SMS or USSD double-opt-in step – the final confirmation was done in the phone’s browser.
The double-opt-in step to subscribe to a WASP service is to ensure a user confirms their desire to pay for the content being offered. This is often done by replying to an SMS or dialling a USSD string.
MyBroadband spoke to MTN and WASPA about the browser-based opt-in page and if it was a standard feature available for subscription service providers.
Johannes Kanis – General Manager: Partnerships, MTN Business – said WASPs are allowed to use a browser-based confirmation page in instances when “an MTN subscriber seeks to subscribe to a WASP service using a WAP portal”.
“MTN does not decide the confirmation method to subscribe to WASP services. As part of MTN’s offering to the WASP, MTN allows WASPs to select the method for the content service approval,” he said.
If the subscriber accesses the WASP’s WAP portal, a double opt-in network-controlled page will be available which allows subscription to the service.
“As part of the subscription process, the WASP is required to inform the MTN subscriber that the latter is able to manage their subscription services via the USSD string *141*5#.”
WASPA said there is no “universally-applicable method” for double-opt-in steps.
Factors that influence the choice of confirmation method depend on a network’s requirements, advertising platforms, and data versus Wi-Fi engagement, said WASPA.
“It is important to note that irrespective of the confirmation method utilised, the confirmation step is controlled and managed by the network,” said WASPA.
“Only once a consumer has actively confirmed his or her consent to join the service by means of the confirmation step, will the WASP receive authorisation from the network to activate the service and be allowed to bill the consumer.”
Cell C and Telkom confirmed that WASPs are also allowed to select which opt-in method they want to use – including the browser-based confirmation page.
“Cell C does not restrict WASPs from using any opt-in channel, however, browser-based opt-in is only possible if the client is on a data session,” said Cell C. Cell C does not currently offer a USSD channel, it added.
Telkom said: “The double-opt-in methods we have available for subscription services are initiated either via SMS, USSD, or a browser-based confirmation page via (WEB/WAP).”
Vodacom said the confirmation request/service notification that is sent to the customer is triggered by Vodacom.
“Vodacom WASPs are allowed to choose how the service is initiated by the customer (via SMS, MMS, WEB, WAP, or USSD) and as a result of that choice, Vodacom will either trigger an SMS service notification or WAP confirmation page which is sent to the customer,” said Vodacom.