The National Telecommunications Agency (Anatel) has established a new determination requiring mobile phone operators to prevent the sending of corporate SMS messages originating from unregistered short codes. This action aims to curb fraudulent schemes that exploit seemingly legitimate identifiers, simulating financial institutions, companies, and government agencies.
This resolution is part of a new set of rules created to combat scams through fake messages and was officially published in the Official Gazette of the Union this Wednesday, November 4th. Furthermore, the regulations mandate a public registry of senders and the use of automated systems to detect suspicious activities. Operators will have up to 90 days to implement these measures.
The main focus of the decision is on so-called A2P (Application-to-Person) SMS, which are messages sent by companies directly to consumers. This format is widely used to dispatch confirmation codes, purchase notifications, bank alerts, and other types of communications.
Many of these communications arrive using short codes, which are few-digit numbers displayed instead of a standard phone number. According to the new guidelines, these identifiers must be mandatorily linked to duly registered companies. Consequently, operators must block the delivery of corporate SMS from codes not listed in the official registry.
It is important to note that this requirement does not imply a total block on messages exchanged between individuals. The fundamental purpose is to enable the identification of those responsible for corporate sends and expedite the tracking of potential fraud.
The administration of this registry can be delegated to ABR Telecom, the entity currently managing portability and roaming systems. ABR Telecom itself had been preparing since January to centralize the numbering contracts used in messaging services in Brazilian territory, as reported by Teletime at the time.
Anatel's new rules provide for the creation of a centralized directory accessible to the public. Through it, consumers will be able to check which company is associated with each short code used for sending SMS. Each identifier must be used by a legal entity, although sharing may be permitted in exceptional circumstances, provided a technical justification is presented to Anatel, at which point all involved companies must be listed in the registry.
According to TeleSíntese information, the fact that a single code is used by multiple senders complicates the location of message origins and reduces the effectiveness of blocking mechanisms. Service providers will also be required to implement automatic systems capable of identifying unusual sending volumes, sender spoofing, and potential fraudulent campaigns.
The obligations also extend to companies that generate or intermediate the messages. Such companies must confirm the identity of the service purchaser, maintain records that allow tracking of sends, and cooperate in fraud investigations.
Deadlines for compliance begin counting from the date of publication of the dispatch. A specific schedule has been established, which includes promoting educational campaigns by operators before the registry opens, aiming to inform users on how to perform the consultation. Although the measures may hinder attacks on corporate messaging systems, they do not eliminate all forms of threat. Smishing, which is a variation of phishing via SMS, allows criminals to trick victims into accessing fake pages to provide personal or banking data. Furthermore, there are scams that use clandestine antennas to simulate telephone networks, causing messages to reach devices without passing through conventional carrier channels. For this reason, simply including a short code in the registry does not guarantee that every message sent by it will be secure.
Anatel will monitor the implementation of these provisions and must receive a detailed report on the results of the fraud combat plan within a maximum period of 180 days.
