Government moves to expand SMS Sender ID registry

Nine months after announcing it would require telcos to use a Sender ID Registry to combat SMS spam, the government has started consultation over whether the scheme should be mandatory or voluntary for Australia’s telcos.

The scheme received a $10.9 million allocation in the May 2023 federal budget.

The registry would create a controlled list of the numbers used by registered brand names.

This would prevent scammers from impersonating participants’ brands, since carriers would block texts using those brands unless the originating number is in the registry.

A pilot of the system has been operating since December 2023. Carriers participating include Telstra, Optus, TPG Telecom and Pivotel.

The pilot initially launched with Commonwealth Bank and the National Australia Bank as its participating brands, and last week ACMA chair Neridah O’Loughlin told a senate hearing Services Australia and the Australian Tax Office had also joined.

ACMA general manager consumer James Fenton told last week’s hearing the pilot’s aim was to “uplift previously existing provider capabilities”, including “ensuring there is consistency of information in the registry, and that it’s a secure central database.

“We are looking to expand the pilot to cover brands that are targeted by scammers because of their profile in the community.”

In June 2023, Fenton told a senate hearing the mandatory/voluntary question was holding back implementation of a scheme that was otherwise “ready to go”.

The rules would require telcos to confirm that someone sending bulk branded SMSs had a legitimate reason to do so, Fenton told the June 2023 hearing.

Fenton also said 44 audits of telcos identified “non-compliance with the Reducing Scam Calls and Scam SMS Code.”

“We’re committed to a national rollout of the registry that works for both Australians and the businesses that serve them,” communications minister Michelle Rowland said.

“Feedback from consumers, businesses, charities and government services will help inform the next phase of the registry.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts