When a delivery is booked, our system sends the customer a text with the date, a time window and a link to track the lorry. The texts arrive under our company name rather than a phone number, which customers like, because they know at a glance who it is from.
In August a builder rang one of our branches to ask why he had paid a redelivery fee of one pound forty five when his delivery had arrived on time. He had not paid us. The night before, he had received a text saying his delivery could not be completed and asking him to pay the fee through a link to rebook. It appeared under our name, in the same conversation on his phone as our genuine messages from the previous month. He had no reason to doubt it. The page behind the link asked for his card details, and within a day the card had been used elsewhere.
Over the following week thirty one customers told us the same story. We do not know how many received the text and said nothing.
What we had to accept was that the sender name on a text is not a proof of anything. It is a label the sending service passes along, and anyone using a service that does not check it can type our name in. Phones group messages by that label, so the forgery sat neatly underneath our real texts. We had also spent years teaching our customers that a text from us contains a link and that tapping it is the normal next step.
We registered our sender name with the SMS SenderID Protection Registry, which is run in the UK by the Mobile Ecosystem Forum. Messaging providers that take part block messages using a registered name unless they come from a sender the owner has authorised. It does not cover every route, but the fake texts carrying our name stopped arriving within a fortnight. We changed our own texts too. They never ask for payment, every link goes to an address on our own domain, and each delivery text now ends with a line saying that we will never ask for money by text. We wrote to every trade customer explaining this and asking them to forward anything suspicious to 7726, the free UK number for reporting spam texts. The branch staff got a short script for anyone who rings about a text, so the answer is the same at every counter.
A name at the top of a message is something anyone can type. If your customers trust it, register it, and make your real messages look like something a forgery cannot copy.
– Serguey Shinder
Top comments (0)