Back to blog
Fraud in Text Messaging
Criminal organizations have figured out that they can abuse the same systems businesses use to engage with customers. To prevent them from hacking into accounts and victimizing customers, most businesses employ MFA (multi-factor authentication) or 2FA (two-factor authentication) to secure their online services, onboarding, and login processes. It can even be used to verify a customer when authorizing money transfers. The most popular MFA strategy is digital verification, often done by sending out OTPs (one-time-passwords) to doublecheck the access rights of the person logging into the account or service. Case closed, problem solved? Sadly, no.
Criminals are persistent and crafty. They learned to abuse automated text communication (like OTPs) by blasting companies with requests to send text messages to toll or premium rate numbers. Each text adding to an exorbitantly high bill for the targeted business, while the fraudsters pocket their profits. This type of fraud is known by names such as toll fraud, IRSF (international revenue sharing fraud), and AIT (artificially inflated traffic).
So how do you prevent becoming the next victim of toll fraud? CM.com offers destination management in our safeguard system to help protect your business, but there's also a new digital verification method available that prevents this type of scam. A method that is more secure, user-friendly, and prevents you from having to send out a high number of OTP messages: Number Verify.
What is Number Verify?
Number Verify, Number Verification, Number Verifier, Mobile Identity, Mobile Identity Authentication, Silent Verification, Silent Network Authentication, passwordless authentication, SAFr Authentication - different names for the same verification method. But what is it?
Number Verify leverages the unique characteristics of the SIM card in mobile devices to authorize and verify the user of your mobile apps. Unlike traditional authentication methods that rely on passwords, knowledge-based authentication, physical tokens, or OTPs, number verify checks the inherent security features of the SIM card to ensure that only authorized users can access sensitive information and services in your mobile app. This way, businesses can trust that the person they are engaging with is the legitimate owner of the mobile number, which helps prevent identity theft.
The user will be asked to enter their telephone number, and nothing else, and the authentication will happen in the background via the mobile operators that supply the SIM verification. Hence it is often referred to as a 'silent' authentication method. Because most of the verification happens in the backend, without any external actions needed. This way, criminals are not given the chance to commit toll fraud.
There is no username, password, or OTP needed for verification. This makes it a quick, seamless, and user-friendly method that simplifies the verification process for both businesses and users.
Key Benefits of Number Verify
Enhanced Security: By using the SIM card, which is inherently secure and difficult to tamper with, Number Verify offers a higher level of security compared to traditional methods.
User Convenience: Users do not need to remember complex passwords or carry additional authentication devices. Their mobile phone, which they already have, becomes the key to access.
Fraud Prevention: Number Verify solutions can detect and prevent fraudulent activities such as toll fraud and identity theft.
Regulatory Compliance: Many industries are subject to strict regulations regarding data protection and user authentication. Number Verify helps businesses comply with these requirements.
Cost-Effective: Reducing the need for physical tokens and complex password management systems can significantly lower operational costs.
How Safe is Number Verify?
Verifying the user's identity via SIM card benefits from the inherent security that SIM cards already have. But what if criminals commit fraud with SIM cards? SIM swap fraud occurs when a fraudster tricks a mobile carrier into transferring a user’s phone number to a new SIM card. They will pretend to have lost the SIM card or the phone when they contact the mobile carrier, asking to have the phone number registered to a new SIM card. This can then give the fraudster access to sensitive accounts and information.
Detecting and Preventing SIM Swap Fraud
Does that make Number Verify unsafe? No, because we're always one step ahead! The SIM swap detection, or Takeover Protection service, helps prevent SIM swap fraud by monitoring and detecting changes in the SIM card. Before executing a transaction, businesses can perform a SIM Swap check which returns the last date the SIM was swapped or activated.
Is there a recent SIM swap registered? Then you as a business can decide the best course of action for that specific user. This allows you to respond to fraud attempts swiftly and enhances the overall security of user accounts and the sensitive information they may contain.
Will Number Verify Replace OTPs?
Is there even a future for SMS OTPs, especially considering the rise in AIT and toll fraud? SMS is considered old, its messages are not end-to-end encrypted, and the prices per text message are creeping up. Some even claim that SMS as an OTP channel will not survive the next lustrum. Whether that forecast is correct or not, only time can tell. But right now, it's too early to write off (SMS) OTPs just yet.
Number Verify needs cooperation from mobile operators, and when it comes to security measures, accessibility is a key factor. What SMS lacks in security, it makes up for in reach and effectiveness. Offering high-tech cybercrime solutions means nothing when these solutions don't reach your customers. SMS is accessible, available, and everywhere. Perfect for a fallback security channel when the first-line solutions are unavailable to a customer.
Besides, SMS is not the only channel that offers OTPs. Newer, end-to-end encrypted channels like WhatsApp Business Platform and RCS are great for sending out OTPs.
WhatsApp OTP
Traditionally, OTPs are send over SMS or email. The problem however, is that these messages are not end-to-end encrypted. And unencrypted messages can be abused by criminals. WhatsApp Business Platform messages are end-to-end encrypted, which adds an additional layer of security to the OTPs send over WhatsApp.
RCS OTP
RCS is often considered the successor of SMS, and rightfully so. RCS introduces rich media and interactive tools to the native text messaging app on Android phones - and soon also to iPhones.
Besides the added rich features, RCS also offers a higher level of security than SMS with its verified business profiles. These verified business profiles help eliminate fraud and spam by requiring businesses to go through a thorough verification process to prove their identity before they can send out RCS text messages. It will also help your customers to recognize imposter OTP messages with malicious links.
More about RCS fraud prevention>
Verification Services Via CM.com
The importance of finding accessible and secure tools to safely grant your customers access to your digital services is clear, but where do you start? Tools currently used for authentication and verification were not necessarily build with that specific use case in mind - and aren't priced as such either. OTPs are generally charged per (text) message sent, regardless of whether or not the verification was successful.
At CM.com we've now bundled our verification and authentication services into one easy and accessible API so you'll have your verification solutions in place in no time. And the best part? You only pay for successful verifications!
Our Number Verify tool is part of our Verification as a Service solution, and our Mobile Identity API. Seamlessly integrate with one of our solutions to offer a seamless experience for both your colleagues and your customers.
