Phishing and Fraud Cut Short: Inside MessageFlow’s SMS Marketing Security Measures

SMS is an incredibly useful channel for both businesses and their customers. Its widespread adoption, directness, and immediacy have multiple use cases. However, they also provide a fertile ground for cyber attacks. I sat down with Daniel Zawiliński, COO of Mobile Communication at MessageFlow, to talk about all the ways in which we make sure our clients’ SMS marketing campaigns are delivered safely.

A recent report involving, among others, security professionals as its data source, has established that 75% of organizations experienced phishing attacks via SMS, also known as smishing attacks, in 2023. That’s a lot, isn’t it?

To effectively safeguard your organization against potential SMS-related risks, it’s important to approach the issue from multiple angles. On one hand, you need to take steps aimed at making sure your organization members don’t fall for smishing attempts.  On the other hand, if SMS communication is a part of your business operations, you must select a trusted service provider who will be able to securely manage and deliver your SMS messages.

Does MessageFlow have what it takes to be considered a truly secure SMS marketing tool? We believe it certainly does, but let’s dive into the details. In this article, we will explore the SMS security features at MessageFlow and explain why it’s a strong choice for large enterprises.

Our base-level SMS marketing security measures

Every MessageFlow customer using its SMS automation module enjoys the essential protection provided by a 360-degree antiphishing shield.

• Its base component works automatically in the background for every user. Its job is to act as the first line of defence. The integration with third-party partners allows it to detect potential fraud or phishing attempts by triggering a validation check against a number of conditions. 

• Its extended component, available as an extra, manually-configurable fraud alert service, focuses on the sender name. This component checks whether a particular sender is indeed authorized to use the sender name they chose. That way, both our team and your customers can be confident that the brand that’s contacting them is indeed who they claim to be.

The technical foundation of our SMS security system

Our SMS automation system has been designed to provide you with a secure environment for the delivery of large-scale text message campaigns.  If you want to launch a campaign, you will receive fundamental protection from the get-go.

Now, let’s say there’s a fraudster trying to take advantage of an unwitting audience via our text marketing system. What steps do we take to prevent that from happening? How do we make sure your brand isn’t being unlawfully used in an SMS phishing attempt? 

Well, we have a number of procedures in place and take a number of steps to ensure the safety of text marketing communication being sent via our platform.

How MessageFlow counteracts smishing and fraud

• We’re ISO 27001-certified. Several of the standard’s stipulations are particularly important for ensuring secure SMS marketing for our clients, including vetting and managing partner relations and legal compliance.
• We engage in extensive collaboration with sister companies, locally-regulated GSM operators, and other officially recognized partners. This allows us to facilitate large-scale checks against established databases of multiple red flags and other fraud markers.
• Relying on our own and our partners’ steadily growing whitelists and blacklists.
• Running advanced algorithmic analyses of the contents of the text messages our customers send out, including the links they contain. This helps us uncover patterns indicative of fraud, making it easier for us to take action.

• Human oversight as an extra layer of protection, which uncovers tens of fraud attempts daily. 
• API integration with relevant software providers (bit.ly, for example) for the purpose of mutual information exchange intended to stop phishing and fraud. We’re feeding our partners the information on our new discoveries and vice versa.
• We take advantage of our many years of experience in the communications industry. We’re able to either block obvious fraud right away or, if a message doesn’t exactly fit the pattern but has been assessed as potential abuse, subject it to additional verification. It will be delivered only if it’s deemed to be safe.
• Undergoing regular, external audits to make sure that we stay strictly compliant with different security laws and regulations.

Two elephants in the room

Discussed above is the general way in which our SMS marketing security system operates. Still, there are two other issues that we need to address. These extend beyond our base set-up, thus requiring a dedicated section in this article.

Message encryption

Encryption is a major messaging buzzword, carrying a promise of privacy in the world where our personal data has become a commodity. It’s a big selling point, especially for providers of various OTT messaging apps like WhatsApp or Viber.

But how does it work for traditional text messages? Is SMS encrypted?

Well, it’s complicated. In essence, there are various factors, including technological and legal ones, dictating how SMS service providers can handle message encryption.

To protect sensitive information while delivering texts, we use VPN tunnels for connection between MessageFlow and GSM operators. This ensures that SMS messages in transit are secure and cannot be intercepted. Additionally, we use SSL encryption for added security, particularly for web-based interactions and API calls.

Once our client’s campaign has been processed and archived, it is then encrypted for its designated storage time.

SMS traffic pumping 

You may or may not be familiar with the concept, but let’s make sure we’re on the same page here. If you’re sending mass texting campaigns, you’re potentially subject to a traffic pumping attack. It’s largely up to the SMS marketing tool provider to take steps to prevent you from falling victim to it.

Traffic pumping is a type of fraud aiming to generate excessive, fake traffic (also referred to as artificially inflated traffic) in a relatively short time. Its perpetrators make multiple requests for a one-time password, a message containing a link, or a test message from an unsecured website form. This might have many negative consequences for your brand.

• Damage to your brand’s reputation. Your customers might end up receiving multiple irrelevant messages, which is bound to cause frustration.
• Skewed campaign analytics. Following an SMS traffic pumping attack, you might find it harder to accurately evaluate your campaign’s performance.
• Increased risk of your sender ID being blacklisted. During a traffic pumping attack, you are bound to trigger various spam filters and anti-fraud mechanisms.
• Legal or compliance risks. If the attack exploits a specific flaw of your security systems, you might be held responsible for not fixing it in time. 
• Excessive strain on your systems. This will result in poorer user experience.
• High costs. The attack might cause your SMS service provider to send you an inflated bill.

To prevent SMS traffic pumping, you can take the following steps.

✅ 1. Implement rate limiting to restrict requests. 

✅ 2. Start using CAPTCHA to block bots. 

✅ 3. Monitor and block suspicious IP addresses. 

✅ 4. Analyze user behavior to detect anomalies. 

Additionally, you should validate sending sources, enforce per-user quotas, and educate teams to recognize fraud indicators, ensuring that your system is secure without disrupting user experience.

Wondering how SMS traffic pumping may affect you in particular? Here’s a hypothetical ecommerce scenario.

Imagine that you’re running an e-commerce store that offers discounts on popular items. To encourage purchases, you’ve set up a system where customers must request a one-time password through a text message to complete their registration or access a special offer.

A fraudster discovers an unsecured form on your website and uses an automated script to generate thousands of OTP requests in a short time. This artificially inflates SMS traffic, causing your campaign costs to skyrocket while overloading your system, delaying legitimate customer requests and frustrating users. Meanwhile, the fraudster benefits either by receiving a commission from the service provider or by sabotaging your system to give your competitors an edge.

In conclusion

I hope that with this article I managed to, first, expand your knowledge and awareness of the cybersecurity threats related to SMS marketing, and second, give you a decent sneak peek into how we protect our customers from these threats.

Now that you’re equipped with all this newly-acquired information, are you ready to prioritize secure SMS marketing at your company? If so, try using a tried and trusted platform like MessageFlow!