Government establishes new rules to combat frauds and scams sent via SMS

The National Telecommunications Agency (Anatel) has established a new determination requiring mobile phone operators to prevent the sending of corporate SMS messages originating from unregistered short codes. This action aims to curb fraudulent schemes that exploit seemingly legitimate identifiers, simulating financial institutions, companies, and government agencies.

This resolution is part of a new set of rules created to combat scams through fake messages and was officially published in the Official Gazette of the Union this Wednesday, November 4th. Furthermore, the regulations mandate a public registry of senders and the use of automated systems to detect suspicious activities. Operators will have up to 90 days to implement these measures.

The main focus of the decision is on so-called A2P (Application-to-Person) SMS, which are messages sent by companies directly to consumers. This format is widely used to dispatch confirmation codes, purchase notifications, bank alerts, and other types of communications.

Many of these communications arrive using short codes, which are few-digit numbers displayed instead of a standard phone number. According to the new guidelines, these identifiers must be mandatorily linked to duly registered companies. Consequently, operators must block the delivery of corporate SMS from codes not listed in the official registry.

It is important to note that this requirement does not imply a total block on messages exchanged between individuals. The fundamental purpose is to enable the identification of those responsible for corporate sends and expedite the tracking of potential fraud.

The administration of this registry can be delegated to ABR Telecom, the entity currently managing portability and roaming systems. ABR Telecom itself had been preparing since January to centralize the numbering contracts used in messaging services in Brazilian territory, as reported by Teletime at the time.

Anatel's new rules provide for the creation of a centralized directory accessible to the public. Through it, consumers will be able to check which company is associated with each short code used for sending SMS. Each identifier must be used by a legal entity, although sharing may be permitted in exceptional circumstances, provided a technical justification is presented to Anatel, at which point all involved companies must be listed in the registry.

According to TeleSíntese information, the fact that a single code is used by multiple senders complicates the location of message origins and reduces the effectiveness of blocking mechanisms. Service providers will also be required to implement automatic systems capable of identifying unusual sending volumes, sender spoofing, and potential fraudulent campaigns.

The obligations also extend to companies that generate or intermediate the messages. Such companies must confirm the identity of the service purchaser, maintain records that allow tracking of sends, and cooperate in fraud investigations.

Deadlines for compliance begin counting from the date of publication of the dispatch. A specific schedule has been established, which includes promoting educational campaigns by operators before the registry opens, aiming to inform users on how to perform the consultation. Although the measures may hinder attacks on corporate messaging systems, they do not eliminate all forms of threat. Smishing, which is a variation of phishing via SMS, allows criminals to trick victims into accessing fake pages to provide personal or banking data. Furthermore, there are scams that use clandestine antennas to simulate telephone networks, causing messages to reach devices without passing through conventional carrier channels. For this reason, simply including a short code in the registry does not guarantee that every message sent by it will be secure.

Anatel will monitor the implementation of these provisions and must receive a detailed report on the results of the fraud combat plan within a maximum period of 180 days.

A vulnerability was discovered in the Telegram application for the Android operating system that allowed attackers to execute arbitrary code on the victim's device after they answered a voice call. This issue was identified by the security company NebuSec and has been fixed in application version 12.10.4.

The vulnerability affected application versions ranging from 8.6.2 to 12.10.3 and was relevant from March 2022 to September 2026. To ensure protection, users are advised to make sure they are using the patched version or a newer one.

The cause of the error lay in the process of handling messages used to configure and display call statuses. When such a message did not contain all expected fields, the code incorrectly accessed a specific area of the device's memory.

NebuSec demonstrated the ability to execute code during a private call accepted on a phone with an ARM64 processor. In a video published by the company, the closing of Telegram and the appearance of the device's main screen with the message 'HACKED BY NEBUSEC' were observed.

Among the characteristics and limitations defined by the company, it was noted that to check the installed version, the user must go to the Telegram settings and view the number at the bottom of the page. Version 12.10.4 resolves this flaw.

Although the applications use a common library for voice and video calls, the fix had already been integrated into the code versions for iPhone and computer even before it reached Android.

On October 29, the vulnerability did not yet have a CVE identifier used for cataloging security vulnerabilities. The publication The Hacker News reported that it contacted Telegram and NebuSec with questions about the application of this vulnerability in real attacks and the scope of executable code on the device.

The initial publication about this vulnerability appeared on the resource Olhar Digital.