Modica, a company that says it specialises in “high volume, enterprise messaging solutions”, is the first to breach Australia’s new anti-SMS scam rules.
Back in July, the Australian Communications and Media Authority (ACMA) registered new rules that require telcos to identify, trace and block SMS scams.
Rules were already somewhat in place as part of the 2020 industry code (the Reducing Scam Calls code), but that was more for phone call spam, not SMS. So now, telcos must also publish information to assist their customers to proactively manage and report SMS scams, share information about scam messages with other telcos and report identified scams to authorities.
The ACMA said an investigation found Modica allowed customers to send SMS using text-based sender IDs (i.e. a name) without making sufficient checks to ensure they weren’t being used to perpetrate scams.
ACMA chair Nerida O’Loughlin said the rules were in place to reduce scams that use sender IDs to pose as legitimate organisations such as government agencies, financial institutions and road toll companies.
“This is a widely used trick used by scammers to gain consumer trust. Sender IDs generally display as a name on mobile phones and impersonating well-known brands allows the texts to slip into legitimate message streams from the brands,” O’Loughlin said.
[related_content first=”1838630″]
She also said that Modica did not have processes in place to ensure all its customers provided evidence to confirm they had a legitimate case to use these text-based sender IDs.
The ACMA said Modica also failed to report to the ACMA the number of scam messages it had blocked for the period between July and September 2022, which is something required by the rules.
“While we did not find evidence any scammers had used the vulnerability created by Modica, its failure to have adequate processes in place put people at risk of receiving SMS scams,” she said.
The ACMA has directed Modica Group Limited to comply with the new rules and while it doesn’t look like the company has been fined, the ACMA said if future breaches are found, Modica may face stronger enforcement action such as commencement of proceedings in the Federal Court.