6 ms·

The Australian Government to Require SMS/MMS Sender ID Registraion

159 points by anitil 4mo ago

JSR_FDED 4mo ago
Singapore does this. Any message that comes from an unregistered sender show up on the phone with “Likely Scam” as the sender name.
- steve_taylor 4mo ago
  The Australian one will label them as Unverified. Personally, I'd prefer them to be blocked. If it's important and legitimate, they'll register.
  - wizzwizz4 4mo ago
    There are good reasons to allow unregistered telecommunications. If you don't like it, you can always block it your end; given that we can all expect many other people to do the same (and it'll likely be a feature built into many phone operating systems), the social pressure you're after still exists.
mDyJzDPmBdG 4mo ago
It is crazy that wasn't something already required. Here local sms-gateways always required paperwork to prove word you want to use as sender name is a brand you own.
anitil 4mo ago
As counter measure to text scams the Australian government (actually ACMA which I think is the Au version of the FCC) has introduced a national register of Sender Ids, which comes in to effect on the 1st of July. It requires providers to mark any unregistered Sender Id as 'Unverified' I haven't yet been able to find the full register (if it's even public) but I thought this is an interesting approach.
ggm 4mo ago
I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. I'm assuming there's a technical and/or willpower reason or some counterfactual like VOIP depends on it. Even just flagging it would help. Or, rejecting numbers they can know lie inside their own routing architecture, or asserts within their own number plan where the CLID does not match. Morally it's like BCP38 in the customer facing internet systems: reject customer input they don't pay you to assert.
- bxk76 4mo ago
  Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.
- fowl2 4mo ago
  Telco networks are sprawling and accurately defining the boundary might be harder than it sounds. Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request. I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.
- edent 4mo ago
  I used to work at two (UK) telcos. There's a historic reason and a modern reason. The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other. A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls. The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email. If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.
steve_taylor 4mo ago
As an Australian, I'm happy to hear this, but also annoyed that a lot of legitimate SMS from companies don't use branded sender ID. I'm not sure why, but my guess is that SMS gateways charge more for it and businesses don't want to pay the extra cent or two.
- ehnto 4mo ago
  That will likely change after this goes into effect, otherwise all that legitimate spam will never make it.
- dools 4mo ago
  No it costs the same, the reason they do it is that it’s slightly more difficult to spoof a real number sender ID because most gateways will verify ownership by sending you a text on that number before letting you send outbound from it, where as they have no way of doing the same for an alphanumeric sender ID
- ticoombs 4mo ago
  Alpha codes don't allow replies. As such if you need to reply it has to be from a number
a_bonobo 4mo ago
Good move, it's crazy how many scam calls and SMS I receive in Australia. In fact, if I get an SMS or a call, I just assume it's a scam.
- UnfitFootprint 4mo ago
  I don’t think this will cut down on spam so much as fraud. All spam calls I get don’t have registered IDs
- justinclift 4mo ago
  Have you added yourself to the Do Not Call register? https://www.donotcall.gov.au https://www.donotcall.gov.au
- gravelc 4mo ago
  The 'Ask Reason for Calling' iPhone feature has completely eliminated scam calls for me. Real callers not in contacts leave a short message and I pick it up. Best iOS feature from the last few years IMO.
  - sevenseacat 4mo ago
    Goddammit, it's iOS 26 only. That sounds super useful!
Nikhil37475 4mo ago
Interesting change. If it helps cut down on spam and phishing texts while keeping branded messages trustworthy, it sounds like a step in the right direction.
Nursie 4mo ago
I welcome this move, enforcing that SMS messages come from who they say they'll come from is important. Personally I think the whole system of replacing the point of origin with a name needs to be overhauled. Allowing a name as well is fine, but the practice of delivering messages that can't be replied to is pretty poor. Rather than have to futz around with a different number or website to go to, I should be able to just reply "STOP" if (for example) Dominos keep spamming me with Pizza offers I don't want.
nephihaha 4mo ago
This sounds connected with their social media restrictions.
- daneel_w 4mo ago
  It's not. Together with ongoing global tightening of regulations for permissible caller IDs on phone calls, it's all about fighting fraud. (I work in the telecom industry and am in the middle of all the waves this is causing for legitimate business cases.)
  - nephihaha 4mo ago
    Yes, we know how that fraud will be fought, with a requirement for a digital ID from the government.
    - inigyou 4mo ago
      But you're okay with the analog ID requirement?
      - nephihaha 4mo ago
        It is not a requirement for me to carry ID at all times where I live, although that mentality is being encouraged. Digital ID is a step down from that.
shevy-java 4mo ago
Governments always want to know everything. They are like the biggest data sniffers now, even more so than e. g. CIA-book (formerly known as Facebook).
- inigyou 4mo ago
  They do, but that's irrelevant to this. Most normal people also don't want phone calls to be completely anonymous or spoofed, and the phone network has never been meant to be anonymous.
  - weezing 4mo ago
    I doubt guy even lived when phonebooks with addresses were a thing.
n2h4 4mo ago
India has something similar, and even goes a step further by having last alphabet as an identifier for Promotional, Services, Govt. etc. https://www.trai.gov.in/advice-to-senders https://www.trai.gov.in/advice-to-senders
codingjoe 4mo ago
Sadly this isn't limited to Australia. RCS the SMS successor does not consider free peering. I believe security is used as an excuse to create a closed ecosystem that surfaces new businesses and therefore innovation. For a community of builders, like this, any barrier to entry will be problem, however we'll intend.
21asdffdsa12 4mo ago
[flagged]
- alhadrad 4mo ago
  To exemplify the magnitude of ignorance exhibited in this statement, let me ask you: Was the NSDAP a socialist party?
heikkilevanto 4mo ago
I am sure there are reasons why this won't work, but could it really be so hard to show both the faked number, and where the call actually comes from, so I could choose which one to add to my block list.
wtmt 4mo ago
In India this has been the regulation for several years, and has helped along with the Do Not Disturb (DND) registration by the end user and rules for senders/callers. Anyone sending bulk SMSes, even if the sending is done through a third party provider like AWS from another country/region, will have to register. [1] The entity, the header, content template (which allows two or three variables/placeholders) need to be registered. A Distributed Ledger (DLT) is used to store these. Ad hoc messages without a registered template are expected to be rejected by the telco. [1]: https://trai.gov.in/advice-to-senders https://trai.gov.in/advice-to-senders
- captn3m0 4mo ago
  And as we can see from Australia, this doesn’t need a blockchain.
- chrismorgan 4mo ago
  As an Australian who moved to India a couple of years ago: I’ve found India’s Do Not Call Register significantly less effective than Australia’s, because telco, ISP, TRAI and other government offices keep on sending spam, a lot of it stuff that will train people to be phished, and if you report them as DND violations, they declare them service-related. And for telco/ISP, they commingle with actual service-related and important transactional messages, so you can’t just block the shortcodes. In Australia, I don’t remember ever really getting spam SMSes. Emails from the bank, yes, but that’s easier to filter if desired. When you get the same old spam messages time after time, you can filter them in email, but text message apps are often not up to that sort of thing. The really stupid thing is that more than half of the spam is about blocking spam. At least once a month, AD-TRAIND-G sends: > స్పామర్లపై చర్య కోసం స్పామ్ను రిపోర్ట్ చెయ్యండి. అయితే, ఫోన్ కాలింగ్ యాప్లో స్పామర్ను బ్లాక్ చేయడం వల్ల స్పామర్పై చర్య తీసుకోబడదు. స్పామ్ను TRAI DND యాప్ లేదా సర్వీస్ ప్రొవైడర్ యాప్ లేదా 1909 లో రిపోర్ట్ చెయ్యండి. TRAI DND యాప్లో రిపోర్ట్ చేయడం సులభం మరియు వేగవంతం, ఈరోజే ఇన్స్టాల్ చేసుకోండి. And AD-AIRDOT-S just sends a random message from a pool of half a dozen or so, mostly English but one or two Telugu, sometimes every few days, sometimes every few weeks. Such as: > Alert: On receiving unwanted SMS , please complain by calling 1909 or send SMS to 1909 in format 'SMS Content, Sender No, dd/mm/yy' or visit bit.ly/2qBK0vp to report through Airtel Thanks App. (Huh, that link is now broken. Used to work. Makes it even more dumb.) I should automate reporting all of this stuff, deliberately to waste their time, and maybe, just maybe, make someone think, “maybe we should stop sending this stuff”. There was also RCS… I turned that off after a bit, because it was being used purely for spam and undesirable stuff, and you couldn’t complain in the same channels. RCS is dead like this.
sevenseacat 4mo ago
I've gotten like five notifications from Telstra about this today. They really want me to know that things might change! Like I don't already get a few spam calls and messages every day

159 points by anitil 4mo ago

Singapore does this. Any message that comes from an unregistered sender show up on the phone with “Likely Scam” as the sender name.

steve_taylor 4mo ago
The Australian one will label them as Unverified. Personally, I'd prefer them to be blocked. If it's important and legitimate, they'll register.
- wizzwizz4 4mo ago
  There are good reasons to allow unregistered telecommunications. If you don't like it, you can always block it your end; given that we can all expect many other people to do the same (and it'll likely be a feature built into many phone operating systems), the social pressure you're after still exists.

mDyJzDPmBdG 4mo ago

It is crazy that wasn't something already required. Here local sms-gateways always required paperwork to prove word you want to use as sender name is a brand you own.

anitil 4mo ago

As counter measure to text scams the Australian government (actually ACMA which I think is the Au version of the FCC) has introduced a national register of Sender Ids, which comes in to effect on the 1st of July. It requires providers to mark any unregistered Sender Id as 'Unverified' I haven't yet been able to find the full register (if it's even public) but I thought this is an interesting approach.

ggm 4mo ago

I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. I'm assuming there's a technical and/or willpower reason or some counterfactual like VOIP depends on it. Even just flagging it would help. Or, rejecting numbers they can know lie inside their own routing architecture, or asserts within their own number plan where the CLID does not match. Morally it's like BCP38 in the customer facing internet systems: reject customer input they don't pay you to assert.

bxk76 4mo ago
Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.
fowl2 4mo ago
Telco networks are sprawling and accurately defining the boundary might be harder than it sounds. Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request. I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.
edent 4mo ago
I used to work at two (UK) telcos. There's a historic reason and a modern reason. The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other. A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls. The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email. If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.

steve_taylor 4mo ago

As an Australian, I'm happy to hear this, but also annoyed that a lot of legitimate SMS from companies don't use branded sender ID. I'm not sure why, but my guess is that SMS gateways charge more for it and businesses don't want to pay the extra cent or two.

ehnto 4mo ago
That will likely change after this goes into effect, otherwise all that legitimate spam will never make it.
dools 4mo ago
No it costs the same, the reason they do it is that it’s slightly more difficult to spoof a real number sender ID because most gateways will verify ownership by sending you a text on that number before letting you send outbound from it, where as they have no way of doing the same for an alphanumeric sender ID
ticoombs 4mo ago
Alpha codes don't allow replies. As such if you need to reply it has to be from a number

a_bonobo 4mo ago

Good move, it's crazy how many scam calls and SMS I receive in Australia. In fact, if I get an SMS or a call, I just assume it's a scam.

UnfitFootprint 4mo ago
I don’t think this will cut down on spam so much as fraud. All spam calls I get don’t have registered IDs
justinclift 4mo ago
Have you added yourself to the Do Not Call register? https://www.donotcall.gov.au https://www.donotcall.gov.au
gravelc 4mo ago
The 'Ask Reason for Calling' iPhone feature has completely eliminated scam calls for me. Real callers not in contacts leave a short message and I pick it up. Best iOS feature from the last few years IMO.
- sevenseacat 4mo ago
  Goddammit, it's iOS 26 only. That sounds super useful!

Nikhil37475 4mo ago

Interesting change. If it helps cut down on spam and phishing texts while keeping branded messages trustworthy, it sounds like a step in the right direction.

Nursie 4mo ago

I welcome this move, enforcing that SMS messages come from who they say they'll come from is important. Personally I think the whole system of replacing the point of origin with a name needs to be overhauled. Allowing a name as well is fine, but the practice of delivering messages that can't be replied to is pretty poor. Rather than have to futz around with a different number or website to go to, I should be able to just reply "STOP" if (for example) Dominos keep spamming me with Pizza offers I don't want.

nephihaha 4mo ago

This sounds connected with their social media restrictions.

daneel_w 4mo ago
It's not. Together with ongoing global tightening of regulations for permissible caller IDs on phone calls, it's all about fighting fraud. (I work in the telecom industry and am in the middle of all the waves this is causing for legitimate business cases.)
- nephihaha 4mo ago
  Yes, we know how that fraud will be fought, with a requirement for a digital ID from the government.
  - inigyou 4mo ago
    But you're okay with the analog ID requirement?
    - nephihaha 4mo ago
      It is not a requirement for me to carry ID at all times where I live, although that mentality is being encouraged. Digital ID is a step down from that.

shevy-java 4mo ago

Governments always want to know everything. They are like the biggest data sniffers now, even more so than e. g. CIA-book (formerly known as Facebook).

inigyou 4mo ago
They do, but that's irrelevant to this. Most normal people also don't want phone calls to be completely anonymous or spoofed, and the phone network has never been meant to be anonymous.
- weezing 4mo ago
  I doubt guy even lived when phonebooks with addresses were a thing.

n2h4 4mo ago

India has something similar, and even goes a step further by having last alphabet as an identifier for Promotional, Services, Govt. etc. https://www.trai.gov.in/advice-to-senders https://www.trai.gov.in/advice-to-senders

codingjoe 4mo ago

Sadly this isn't limited to Australia. RCS the SMS successor does not consider free peering. I believe security is used as an excuse to create a closed ecosystem that surfaces new businesses and therefore innovation. For a community of builders, like this, any barrier to entry will be problem, however we'll intend.

21asdffdsa12 4mo ago

[flagged]

alhadrad 4mo ago
To exemplify the magnitude of ignorance exhibited in this statement, let me ask you: Was the NSDAP a socialist party?

heikkilevanto 4mo ago

I am sure there are reasons why this won't work, but could it really be so hard to show both the faked number, and where the call actually comes from, so I could choose which one to add to my block list.

wtmt 4mo ago

In India this has been the regulation for several years, and has helped along with the Do Not Disturb (DND) registration by the end user and rules for senders/callers. Anyone sending bulk SMSes, even if the sending is done through a third party provider like AWS from another country/region, will have to register. [1] The entity, the header, content template (which allows two or three variables/placeholders) need to be registered. A Distributed Ledger (DLT) is used to store these. Ad hoc messages without a registered template are expected to be rejected by the telco. [1]: https://trai.gov.in/advice-to-senders https://trai.gov.in/advice-to-senders

captn3m0 4mo ago
And as we can see from Australia, this doesn’t need a blockchain.
chrismorgan 4mo ago
As an Australian who moved to India a couple of years ago: I’ve found India’s Do Not Call Register significantly less effective than Australia’s, because telco, ISP, TRAI and other government offices keep on sending spam, a lot of it stuff that will train people to be phished, and if you report them as DND violations, they declare them service-related. And for telco/ISP, they commingle with actual service-related and important transactional messages, so you can’t just block the shortcodes. In Australia, I don’t remember ever really getting spam SMSes. Emails from the bank, yes, but that’s easier to filter if desired. When you get the same old spam messages time after time, you can filter them in email, but text message apps are often not up to that sort of thing. The really stupid thing is that more than half of the spam is about blocking spam. At least once a month, AD-TRAIND-G sends: > స్పామర్లపై చర్య కోసం స్పామ్ను రిపోర్ట్ చెయ్యండి. అయితే, ఫోన్ కాలింగ్ యాప్లో స్పామర్ను బ్లాక్ చేయడం వల్ల స్పామర్పై చర్య తీసుకోబడదు. స్పామ్ను TRAI DND యాప్ లేదా సర్వీస్ ప్రొవైడర్ యాప్ లేదా 1909 లో రిపోర్ట్ చెయ్యండి. TRAI DND యాప్లో రిపోర్ట్ చేయడం సులభం మరియు వేగవంతం, ఈరోజే ఇన్స్టాల్ చేసుకోండి. And AD-AIRDOT-S just sends a random message from a pool of half a dozen or so, mostly English but one or two Telugu, sometimes every few days, sometimes every few weeks. Such as: > Alert: On receiving unwanted SMS , please complain by calling 1909 or send SMS to 1909 in format 'SMS Content, Sender No, dd/mm/yy' or visit bit.ly/2qBK0vp to report through Airtel Thanks App. (Huh, that link is now broken. Used to work. Makes it even more dumb.) I should automate reporting all of this stuff, deliberately to waste their time, and maybe, just maybe, make someone think, “maybe we should stop sending this stuff”. There was also RCS… I turned that off after a bit, because it was being used purely for spam and undesirable stuff, and you couldn’t complain in the same channels. RCS is dead like this.

sevenseacat 4mo ago

I've gotten like five notifications from Telstra about this today. They really want me to know that things might change! Like I don't already get a few spam calls and messages every day