From this morning, Irish phone users will see the words “likely scam” on their handset whenever they receive an SMS message that uses a sender ID which has not been listed with the national registry. However, this phase of the new anti-scam obligations imposed by the Irish comms regulator, ComReg, will only last for 3 months. Irish comms providers will begin automatically blocking messages with unregistered sender IDs on October 3.
Organizations that have not yet registered their sender IDs cannot complain that they received insufficient notice. Per ComReg’s figures, over 8,000 organizations have registered over 11,000 Sender IDs ahead of the deadline. There is a simple online form to instigate the registration process.
Anyone can easily check who has registered an Irish sender ID. This is an important step in empowering consumers to protect themselves. Just because a message is authentic does not mean it is legal or justified. The ability to confirm the legal entity that registered a sender ID means there can be no doubt about who is legally responsible for the message. Corporations will not be able to spam consumers then pretend that the messages were spoofed or that somebody else is to blame. Sender ID registries are being adopted by more countries worldwide and I hope they will all exhibit this same level of transparency. The search engine for Ireland’s sender ID registry can be accessed here.
The Irish are using a token-based system to communicate who has registered their sender IDs. Expect to see more countries adopting token-based systems to validate SMS messages and other comms traffic in future. It is good to see the progress being made with techniques to prevent criminals making communications that impersonate legitimate organizations. However, the rapidity of progress in leading nations comes at the cost of limited cross-border coordination so far.
Telcos that carry international traffic face the challenge of needing to satisfy multiple different validation regimes without any current prospect of them becoming interoperable. The biggest global users of communications, such as enterprises like Amazon, will undoubtedly lobby for a degree of harmonization between national registration schemes so their brand will be consistently protected without the need to overcome different bureaucratic hurdles for each market. Despite this, progress towards the cross-border exchange of validation data has been negligible so far.
From what I have seen of negotiations that are meant to promote cross-border cooperation, they have mostly been stymied by big businesses adopting a condescending attitude towards those comms regulators who are rightly placing more emphasis on consumer protection than before. There has perhaps been a tendency for some businesses to negotiate favorable terms in specific countries, then try to pressure other countries to accept the same arrangements. Now would be a good time for national regulators to arrive at common positions negotiated and agreed with each other, so they have a unified bargaining position when they speak to comms providers. This may actually benefit comms providers, included those run by the most short-sighted executives, because consistently demanding higher standards may be cheaper and more efficient than different nations continuing to apply disparate expectations to essentially similar kinds of traffic.
There are some signs of a consensus forming among the nations that have the most comprehensive anti-scam strategies for networked comms. Ireland is one of those nations. The question is whether smaller, nimbler countries will influence bigger countries whose cultures are less likely to look outward and take inspiration from the work of others. Industry insiders thought it was radical of Singapore’s comms regulator, the Infocomm Media Development Authority (IMDA), to introduce ‘likely scam’ warnings for unregistered SMS senders in January 2023. The automatic blocking of unregistered messages followed later that year. I noted at the time:
Other countries are likely to follow the example of Singapore if they successfully reduce spam and scam SMS messages.
Singapore’s methods have been successful, and other countries have followed their lead. But that is no guarantee that all regulators and governments will be equally wise. Many of them talk about the need for greater international cooperation. Consistency comes before cooperation, and compromise comes before consistency. There is no one voice that can speak with authority on behalf of the comms industry because there are too many competing interests within the industry. This places the burden on national authorities to go beyond a national perspective. Those regulators which are in the vanguard for tackling scams, including ComReg and IMDA, will do everybody a favor if they can find ways to accelerate the formation of a consensus with each other, so they may then exert more influence on the rest of the world.
