SINGAPORE – From January 31, all organizations will be required to register with a government-backed central registry if they communicate with the public using SMS messages with sender IDs bearing branded names.
From the end of October, telecom operators here will also start deploying automated filters on their network to weed out potential SMS scams, as part of the latest countermeasures following January phishing attempts that defrauded 13 $.7 million to 790 OCBC bank customers.
Mandatory registration applies to organizations using alphanumeric sender IDs, which typically contain brand names and may contain a mix of letters and numbers.
The decision to deploy the twin countermeasures comes after a month-long public consultation that ended in mid-September.
In its ruling on Friday, the Infocomm Media Development Authority (IMDA) said it had received support from the public and traders to roll out the measures.
“This is part of the multi-pronged effort by IMDA and other stakeholders to further protect SMS as a communication channel,” he said in a statement Friday.
Singapore’s SMS Sender ID Registry (SSIR), which started operating in March, is said to be able to detect and block spoofed SMS in advance. Until now, its use was voluntary.
However, for a period of six months from January 31, all unregistered SMS sender IDs will carry the header “Likely-SCAM”.
After the six months, all SMS with unsaved SMS sender IDs will be blocked by default.
Only SMS with saved sender IDs will be allowed to the public.
The process should give the public better assurance that only bona fide organizations use sender IDs bearing their brand name.
OCBC customers fell for phishing scams by clicking on embedded links earlier this year because the text message they received had spoofed OCBC Bank as the sender.
SSIR is operated by subsidiary IMDA Singapore Network Information Centre, which will charge a one-time registration fee of $500 and an annual fee of $200 for each Protected Sender ID.
Since its launch, more than 120 public and private sector organizations – including leading retail banks DBS, UOB and OCBC, e-commerce company Shopee, insurer AIA, the Singapore Stock Exchange and the Central Provident Fund Board – are registered.
Organizations – both local and foreign – that register with SSIR must first submit a Local Unique Entity Number (UEN).
Over 563,000 business entities listed with the Accounting and Business Regulatory Authority have received UENs.
All SMS aggregators that handle alphanumeric sender IDs must be licensed by IMDA and register with SSIR before they can send SMS to the public.
So far, only banks are banned from including clickable links in text messages or emails to retail customers.