It doesn’t get airtime, but SMS faking hasn’t gone away – far from it.
This type of fraud is an everyday struggle in the SMS ecosystem. Potentially costing a large MNOs millions of dollars per year, P2P SMS global title faking is a popular form of international revenue share fraud.
It works like this: A fraudster sends SMS messages to MNO subscribers. Sometimes they use fake sender information belonging to a different carrier. The recipient MNO then invoices the owner of the faked information rather than the fraudster and the actual originating MNO.
As the actual sender details are hidden at the billing layer, none of the carriers involved can process the billing correctly. And sadly, as the tools needed to perform this type of fraud are easy to get hold of, it’s relatively easy to pull off.
Fraudsters use faking to sidestep the cost of SMS termination. It’s also a convenient and cost-effective way to send spam and malware attacks (phishing). Typically, content includes links to commercial apps/services or marketing campaigns.
To see how badly faking impacts recipient MNOs, let’s look at two faking examples where the issue was identified after invoicing. An in-depth investigation uncovered the root cause – faking in conjunction with insufficient traffic spike monitoring.
The conclusion? Global title faking can account for up to 90% of the total termination P2P traffic invoice.
Example one shows an MNO that didn’t bring in stricter monitoring or anti-faking measures. The faking continued for 3 months.
Example two shows an MNO that brought in strict anti-faking measures in month 3. The faking reduced massively.
Large MNOs are more likely targets for faking because of their large subscriber bases. Also, they often have more budget and manpower to fight fraud attacks.
Let’s dig a bit deeper into how global title faking works in SMS.
The graphic below shows that the fraudster only sends their actual address information in the first message to the receiving MNO (see #1).
The fraudster has to provide accurate routing information at this stage to get the information they need to route the SMS to the end-user.
Once the fraudster gets the correct routing information, they can change the message content and the billable information (see #3).
Now the fraudster can remove their actual sender information and replace it with details from another carrier. As SMS is billed in this third leg of the journey, the fraudster avoids paying for message delivery.
Unless they’ve taken steps to protect against faking, it could be months before a recipient MNO finds an issue. In most cases, it comes to light when the owner of the information queries an invoice.
According to standard contracts and industry practices, the impersonated MNO isn’t responsible for questionable costs. If the fraud happened some time ago, the receiving MNO might struggle to find information on the fraudster – the original routing requests might no longer be in their systems.
As well as the lost termination revenue for MNOs, troubleshooting costs can be massive if several employees spend hours trying to get to the bottom of each case. Intensive investigations can cost more than 4K EUR each, depending on difficulty and employees involved.
These attacks will continue unless targeted MNOs put anti-faking measures in place. Blocking spoofed carrier addresses only damages the messaging ecosystem: Routing information is public, so fraudsters can simply switch to valid information owned by a different MNO.
The best way to fight this type of fraud is to verify information in both steps of the SMS transmission process and engage the fraudster before it is too late.
Are you affected by faking? For more information check out our SMS Firewall and SMS for Operators offer or contact us or your account manager.
Read our next blog post in this series Global title faking in SMS: How to fight back, where we take a technical look at how global title faking works, dive into what MNOs can do to address it and discuss how Sinch can help.
When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
Cookie Statement
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.
Cookie details
Cookie Subgroup | Cookies | Cookies used |
---|---|---|
eu5.mm.sdi.sinch.com | ASP.NET_SessionId | First Party |
community.sinch.com | AWSALB , LiSESSIONID | First Party |
appengage.sinch.com | dd_cookie_test_ | First Party |
tickets.sinch.com | atlassian.xsrf.token , JSESSIONID | First Party |
cockpit2.sinch.com | SESSION | First Party |
engage.sinch.com | instapage-variant-xxxxxxxx | First Party |
dashboard.sinch.com | cookietest | First Party |
brand.sinch.com | PHPSESSID , AWSALBCORS | First Party |
sinch.com | __cf_bm , OptanonConsent , TEST_AMCV_COOKIE_WRITE , OptanonAlertBoxClosed , onesaasCookieSettings, QueryString, functional-cookies, performance-cookies, targeting-cookies, social-cookies lastExternalReferrer, lastExternalReferrertime, cookies, receive-cookie-deprecation _gdvisitor, _gd_session, _gcl_au, _fbp, _an_uid, _utm_zzses, lpv | First Party |
mediabrief.com | __cf_bm | Third Party |
recaptcha.net | _GRECAPTCHA | Third Party |
cision.com | __cf_bm | Third Party |
techtarget.com | __cf_bm | Third Party |
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous.
If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
Cookie details
Cookie Subgroup | Cookies | Cookies used |
---|---|---|
community.sinch.com | ValueSurveyVisitorCount | First Party |
buzz.sinch.com | instap-spid.8069 , instap-spses.8069 | First Party |
appengage.sinch.com | _dd_s | First Party |
sinch.com | AMP_TLDTEST , rl_page_init_referrer , rl_trait , _vis_opt_s , __q_state_dp56h9oqwhna9CoL , cb_user_id , __hstc , rl_anonymous_id , rl_user_id , initialTrafficSource , _vwo_uuid , _vwo_uuid_v2 , rl_page_init_referring_domain , _hjIncludedInSessionSample_xxx , apt.uid , __hssrc , test_rudder_cookie , cb%3Atest , __hssc , rl_group_trait , _hjAbsoluteSessionInProgress , _vwo_referrer , _vwo_sn , _vis_opt_test_cookie , _hjFirstSeen , _hjTLDTest , _hjSession_xxxxxx , s_sq , _vwo_ds , rl_group_id , _vis_opt_exp_n_combi , s_cc , _gclxxxx , cb_anonymous_id , cb_group_id , apt.sid , rl_session , _uetvid , AMP_899c7e29a9 , _hjSessionUser_xxxxxx | First Party |
brand.sinch.com | AMP_TEST | First Party |
engage.sinch.com | no-cache , instap-spses.85bb , instap-spid.85bb | First Party |
www.sinch.com | d-a8e6 , s-9da4 | First Party |
nr-data.net | JSESSIONID | Third Party |
sinch-en.newsroom.cision.com | _ga, _gid | Third Party |
sinch.in | _ga_xxxxxxxxxx, _gat_UA-XXXXXX-X, _gid, _ga | Third Party |
g.fastcdn.co | instap-spses.85bb | Third Party |
hello.learn.mailjet.com | pardot, visitor_id, visitor_id##### | Third Party |
www.googletagmanager.com | userId | Third Party |
hello.learn.mailgun.com | visitor_id#####, visitor_id | Third Party |
dev.visualwebsiteoptimizer.com | _vwo_ssm | Third Party |
box.com | box_visitor_id | Third Party |
app.box.com | z, cn | Third Party |
sinch-tfn.paperform.co | laravel_session | Third Party |
go.sinch.in | visitor_id#####, visitor_id | Third Party |
Qualified | __q_local_form_debug | Third party |
Rudderstack | rudder.inProgress, rudder.3156dd1f-7029-4600-ae54-baf147d9af20.queue, rudder.3156dd1f-7029-4600-ae54-baf147d9af20.ack, rudder.3156dd1f-7029-4600-ae54-baf147d9af20.reclaimStart, rudder.3156dd1f-7029-4600-ae54-baf147d9af20.reclaimEnd, | Third party |
6sense | _6senseCompanyDetauls, _6signalTTL | Third party |
Appcues | apc_local_id, apc_user | Third party |
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device.
If you do not allow these cookies, you will experience less targeted advertising.
Cookie details
Cookie Subgroup | Cookies | Cookies used |
---|---|---|
investors.sinch.com | visitor_id | First Party |
community.sinch.com | VISITOR_BEACON , LithiumVisitor | First Party |
sinch.com | _uetsid , ajs_user_id , _gcl_aw , ajs_group_id , AMCV_ , __utmzzses , _fbp , _gcl_au , AMCVS_ | First Party |
go.latam.sinch.com | visitor_id##### , pardot | First Party |
linkedin.com | li_gc, bcookie, lidc, AnalyticsSyncHistory, UserMatchHistory, li_sugr | Third Party |
pi.pardot.com | lpv151751, pardot | Third Party |
hsforms.com | _cfuvid | Third Party |
google.com | CONSENT | Third Party |
sinch.in | _gclxxxx, _gcl_au | Third Party |
www.linkedin.com | bscookie | Third Party |
bing.com | MUID, MSPTC | Third Party |
www.facebook.com | Third Party | |
hello.learn.mailgun.com | pardot | Third Party |
www.youtube.com | TESTCOOKIESENABLED | Third Party |
dev.visualwebsiteoptimizer.com | uuid | Third Party |
g2crowd.com | __cf_bm | Third Party |
pardot.com | visitor_id#####, visitor_id | Third Party |
tracking.g2crowd.com | _session_id | Third Party |
hubspot.com | __cf_bm, _cfuvid | Third Party |
doubleclick.net | test_cookie, IDE | Third Party |
youtube.com | CONSENT, VISITOR_PRIVACY_METADATA, VISITOR_INFO1_LIVE | Third Party |
go.sinch.in | pardot | Third Party |
liadm.com | lidid | Third Party |
www.google.com | _GRECAPTCHA | Third Party |
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies, then some or all of these services may not function properly.
Cookie details
Cookie Subgroup | Cookies | Cookies used |
---|---|---|
portal.sinch.com | pnctest | First Party |
partner.appengage.sinch.com | _dd_s | First Party |
investors.sinch.com | First Party | |
community.sinch.com | LithiumUserInfo , LithiumUserSecure | First Party |
tickets.sinch.com | selectedidp | First Party |
engage.sinch.com | ln_or | First Party |
cockpit2.sinch.com | CSRF-TOKEN , NG_TRANSLATE_LANG_KEY | First Party |
sinch.com | apt.temp-xxxxxxxxxxxxxxxxxx , hubspotutk , ajs%3Acookies , cf_clearance , ajs%3Atest , __tld__ , __q_domainTest , pfjs%3Acookies , ajs_anonymous_id | First Party |
auth.appengage.sinch.com | AUTH_SESSION_ID , KEYCLOAK_3P_COOKIE , KEYCLOAK_3P_COOKIE_SAMESITE , KC_RESTART , AUTH_SESSION_ID_LEGACY | First Party |
www.recaptcha.net | _GRECAPTCHA | Third Party |
boxcdn.net | __cf_bm | Third Party |
d2oeshgsx64tgz.cloudfront.net | cookietest | Third Party |
sinch-np.paperform.co | XSRF-TOKEN, laravel_session | Third Party |
vimeo.com | __cf_bm, vuid | Third Party |
sinch-ca-sc.paperform.co | XSRF-TOKEN, laravel_session | Third Party |
box.com | site_preference | Third Party |
app.box.com | bv | Third Party |
sinch-tfn.paperform.co | XSRF-TOKEN | Third Party |
cision.com | cf_clearance | Third Party |
These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
Cookie details
Cookie Subgroup | Cookies | Cookies used |
---|---|---|
community.sinch.com | ln_or | First Party |
sinch.in | _fbp | Third Party |
youtube-nocookie.com | CONSENT | Third Party |
youtube.com | YSC | Third Party |