Pulses have been set racing by the news that Telegram, the cloud-based instant messaging service, is inviting a portion of its user base to send SMS messages containing one-time passwords (OTPs) on Telegram’s behalf (pictured). Although the service has only been offered to a limited number of Telegram users, its existence was amplified by Telegram Info English, which then prompted a flurry of concern from mainstream tech journalists. Telegram’s essential concept will be familiar to anyone with experience of other schemes that avoid wholesale telecom charges by finding a way to send traffic that is charged per a cheaper retail tariff instead. Many phone users are on plans that include an allowance for ‘free’ SMS messages, so if they have Telegram installed on their smartphone they could potentially give the app permission to create new SMS messages that will reduce Telegram’s expenditure without necessarily incurring any additional cost to themselves. The terms for Telegram’s new peer-to-peer login service says users who participate will send SMS messages containing OTPs that will permit other users to authenticate themselves when they log into Telegram. So what is the potential impact for wholesale carriers of SMS traffic? And is there a threat that Telegram might further leverage its 900 million monthly users by renting out the same SMS relay capabilities to other firms wanting a cheaper way to send text messages?
If you are a Telegram user and had not previously heard about the new peer-to-peer login service then you are not alone. According to Telegram, the service is restricted to particular countries and is only being offered to 0.01% of users, which equates to around 90,000 people. Separate reports indicate it is only being offered to users with Android phones. Per the written terms, the offer consists in giving Telegram permission to send up to 150 SMS messages each month in exchange for a free upgrade to Telegram’s premium plan. Some descriptions shown to users refer to a lower maximum of 100 SMS messages per month, and users can gift the free upgrade to somebody else. Given the modest scale of the roll-out, this appears to be a trial to see how many users will take the deal rather than a determined plan to turn millions of phones into virtual simboxes. Most of Telegram’s historic revenues have been generated from fees charged to the relatively small portion of their base that have the premium plan, although the company claims that advertising revenues have grown rapidly in recent months. If every user received a free premium plan then the company would be damaged by the loss of subscription revenues. This means there is an effective cap on how many users could be allowed to take this new deal. The fee for the premium Telegram plan varies from country to country but is around USD5 per month.
Most critics working for the mainstream media emphasized the privacy implications of taking this offer. Each user who accepts the deal is agreeing to send SMS messages to people they do not know, and hence sharing their phone number in the process. Bad people dial and message phone numbers at random, as well as obtaining databases of numbers revealed through privacy breaches, so the risk to an individual who allows their phone number to be given to a stranger can be exaggerated. Nevertheless, crazies could treat the receipt of such messages as an invitation to plague the phone of the person who sent them, and Telegram’s terms make it clear that they will not be held liable for any consequences.
Critics concentrated on the fact that anyone taking the SMS relay offer is compromising their own privacy, but there are also privacy implications for other Telegram users too. The phones that send SMS messages will log the phone number of the recipient, and the password within that message will also be visible to the sender. The risk of somebody using this knowledge to hijack somebody else’s Telegram account will likely be mitigated by the password only being effective for a limited period of time. The process of issuing OTPs should also mitigate the risk of abuse, because anybody newly installing Telegram on a phone will need to request a new password, as well as taking control of one specific phone number, making knowledge of previous passwords irrelevant. However, crooks spend more time looking for methods to exploit data than I do, so perhaps they will find a way to take advantage of this too. For example, there may be a way that an insider working for a phone company may systematically compromise Telegram accounts using this information.
However serious the privacy risks are, it is not clear that users will consider the nominal saving of a $5 fee to be such good value. If a user travels abroad and sends SMS messages on behalf of Telegram whilst roaming they may well find themselves worse off than if they simply paid the flat fee for the premium plan. Nor is the premium plan such a great improvement on what Telegram users obtain for free. The benefits of the premium plan include: giving users double the limits for such things as the number of channels they can follow (1,000 instead of 500) and the number of GIFs they can save to their favorites (400 instead of 200); faster download speeds; voice-to-text conversion; real-time translation; and custom emojis. This might matter to some people, but the vast majority of the non-paying users are likely to be satisfied with what they already have. Estimates vary, but less than 1 percent of current Telegram users have a premium plan, implying the vast majority do not think the additional features offered by the premium plan are really worth $5 per month.
The most confused aspect of this offer relates to a different aspect of the privacy issue. Telegram is especially popular in countries like Iran and Uzbekistan where the populations are rightly concerned about surveillance. Telegram’s main selling point is the assured privacy of users, which is why it has typically picked up large numbers of users when concerns have been raised about other messaging services being vulnerable to snooping. Mandatory registration of each mobile phone number to a specific named user is the norm in countries where state surveillance is intrusive and widespread. So it is deeply counterintuitive that the users who are most motivated to install Telegram on their phones would be so unconcerned about their privacy that they would broadcast the fact that their phone has Telegram installed.
It may well be the case that this scheme could theoretically save Telegram most money in countries with repressive governments because those countries will also tend to have more expensive wholesale rates for SMS. Theory will not equate to practice because Telegram will be less able to leverage a user base that only chooses to use Telegram because they worry about the threat of their communications being spied upon. Imagine a scenario where the state security services knowingly undermine consumer privacy by registering phone numbers with Telegram, applying to join this peer-to-peer login scheme, then recording all the phone numbers for the messages they relay. The surveillance agency could then target those phones for spyware. They might even impersonate Telegram, because Telegram has set an expectation that users will receive messages from unrecognized phone numbers. I found it difficult to think of ways that visibility of OTPs and phone numbers could be exploited by crooks, but it is much easier to envisage how a draconian government would take advantage.
It is possible that Telegram will only offer this SMS relay service in countries that sit within a ‘sweet spot’ where wholesale SMS fees are high, there is a large number of Telegram users, but the public is less concerned about privacy. Indonesia might be an example of such a country. But despite the initial sense of panic this offer has prompted in some industry circles, I consider the risk to global telecoms revenues to be extremely limited because so few countries have all the necessary characteristics for this service to take significant amounts of traffic away from conventional SMS providers.
The assured privacy of Telegram is the reason why many of its power users are hackers and terrorists. So those users will not be bartering away their privacy for custom emojis either. Telegram’s management team were right to perform a limited trial before drawing more attention to this new service. The more you examine the proposition, the more you find yourself searching for consumers who fit a profile that would be easier to find on other internet comms platforms that appeal to users who have never cared about their privacy. Telcos would have more reason to worry if an app like TikTok started co-opting users’ phones to send SMS messages.
So why would Telegram risk damaging its own reputation as a secure provider of messaging services in order to generate minor cost savings? I believe the real explanation lies in the difference between the way a business generates profit, and the way a business owner generates a return on their investment. Pavel Durov founded Telegram in 2013 and continues to be its owner and CEO. Despite holding such a prominent position for such a popular app, Durov has generally been reluctant to talk to the press, but he recently began courting the mainstream media in order to boost his company’s valuation. Last month, Durov told the Financial Times that new revenue streams have helped the company to generate hundreds of millions of dollars. This would be a big improvement, as there is no reason to believe Telegram ever reached USD100mn of revenue in any previous financial year, and it has never been profitable. Durov says he expects Telegram to be profitable next year, and possibly this year. This is an important claim, because it helps to justify Durov’s assertion that Telegram is worth USD30bn, which he expects to realize by listing the company on a major stock market through an initial public offering (IPO), possibly as soon as 2026.
The wild world of tech finance has made it possible to understand how a company that has always made losses can still credibly believe it will collect USD30bn from investors in a few years from now. Telegram’s backers have already provided debt finance of USD2bn to propel the company this far, and they would expect to generate a considerable return after a successful floatation. But even outlandish confidence about future sales prospects needs to be rooted in some essential facts about a business, which explains why Telegram is now trying to find all sorts of ways to monetize the near billion users it has amassed so far. This includes doing a lot of things that similar companies have done: selling adverts, charging fees to users, and incentivizing content creators by giving them a cut of the revenue generated by the eyeballs drawn to their content. It also means experimenting with some more radical business models, such as encouraging bots that leverage Telegram’s network to automate the trade of cryptocurrencies. But companies do not just enhance profits by chasing new revenues. Cutting costs also matters. That is why cutting the cost of A2P SMS messages sent by Telegram can have an outsized impact on the perceived value of the business.
It was Grand Master Elon Musk who already pointed out that internet comms businesses are wasting far more on SMS OTPs than they should. His concern was that Twitter expenditure on OTP messages had been massively and fraudulently inflated by the use of bots. These bots only existed to create new Twitter accounts that would stimulate revenues for businesses involved in the delivery of OTP messages for two-factor authentication. Musk responded by applying a simple method to cut Twitter’s SMS expenditure: he stopped the sending of OTPs by SMS for any non-paying users. US tech journalists who understand nothing about telecoms completely misinterpreted this decision as a crude attempt to force users into paying more. They failed to grasp that Musk was telling the truth: he said he was cutting costs, and that is what he did. Telegram was hinting at the same objective with one of the phrases used to describe their new SMS relay service.
To help ensure that users in all areas can reliably receive OTPs…
This quote is taken from the beginning of the terms for the Telegram’s new SMS relay service. It is a subtle reference to ‘trashing’, the systematic exploitation of businesses by telcos which are paid to convey A2P SMS messages but who do not intend to deliver them. Whilst allowing artificial inflation of traffic to run rampant, the telecoms sector has done nothing to mitigate the biggest flaw in bulk sending of SMS messages, which is that there is no confirmation of whether any messages actually get to the intended recipients. Enterprise customers who pay for A2P SMS can effectively be paying for nothing. With that being a known problem for A2P SMS, it makes sense for Telegram to mitigate their risk, as well as reducing their cost, by asking if users will send the same SMS using P2P channels instead. Even the name of the service is a clue to their thought processes; they consciously chose to call it their peer-to-peer login service.
Members of the telecoms community are upset by the perceived risk of Telegram bypassing conventional routes for A2P SMS. They may well be upset, but what comes around goes around. Telegram’s initiative could do them some harm, but the A2P SMS business community did more harm to itself by allowing the greedy exploitation of bots that fooled companies like Twitter into generating many meaningless OTPs. They do further harm by presenting themselves as incapable of tackling trashing. Rather than exclusively looking at ways to stifle competition like this, telcos should sometimes concentrate on how to make their services more attractive.
Musk has taught his peers many things, though he may not be so pleased that one of his lessons is not to spend USD44bn on purchasing Twitter, a small internet comms business which has historically been unprofitable, generates limited revenue, and only gained a massive valuation because it serves lots of non-paying users who may not even be real people. It is not hard to see a comparison to Telegram. Durov has seen Twitter’s struggles being played out very publicly, but he has to hype the potential of his firm ahead of a possible IPO. He says Telegram is worth USD30bn and will be profitable soon. People like Musk and Durov do not give a fig for telcos who, from their perspective, may well be ripping them off. If they can boost a company’s valuation by billions just by shaving a few million off their annual costs, they will not hesitate to deny some carrier a fraction of a cent per SMS message. They will also have some justification for behaving like this.
Telcos dependent on thin margins will not be able to withstand the onslaught of companies buoyed by absurd stock market multiples unless telcos can show their services deliver guaranteed value. Companies like Twitter and Telegram are only trying to cut costs at the moment, but the missteps taken by telcos also draw attention to opportunities for tech firms to generate new revenues, not by charging users more for existing services, but by offering new comms services that compete with telcos. Telcos need to regain the upper hand by linking messaging services to the confirmation of delivery, instead of expecting to be paid on trust that has not been earned. If the telecoms industry does not evolve in that direction, then other tech players will make the leap, and will then use their advantage to permanently take market share away from telcos.
