Australian Government Passes SMS Sender ID Legislation

On 22 August 2024, the Australian government has passed amendments to the Telecommunications Act to introduce an SMS Sender ID Register.

The Sender ID Register is to be administered by ACMA (Australian Communications and Media Authority) and will allow approved entities to register Sender IDs for use with SMS and MMS messaging.

What is a Sender ID?

A Sender ID is a text identifier used on an SMS or MMS in place of the originating phone number. The process is known as "spoofing". For example: Instead of the SMS being from "+61 412 34567", the SMS could appear to be from "Business Name".

Why is Sender ID Spoofing an Issue?

Typically, the Sender ID would represent the name of the organisation sending the message – for example, the name of a bank, telco or business. The advantage of a Sender ID is that it is more user friendly for consumers, allowing them to easily identify the sender of the SMS or MMS.

However, to date Sender IDs have not been subject to any verification process. This has allowed illegitimate uses of spoofed Sender IDs to impersonate legitimate organisations.

For example, a scammer might send an SMS spoofed with the name of a bank as the Sender ID. A bank customer receiving the message may then be deceived into believing the SMS was legitimately sent by the bank. Clicking on a malicious link contained in the SMS could then be used for phishing, identify theft or to compromise the customer’s bank account.

It has been reported that in some cases, a malicious message with a matching Sender ID might appear on the customer’s device in the same message thread as legitimate messages.

How with the Sender ID Register Work?

The Sender ID Register is proposed to be administered by ACMA, the Australian regulator of the telecommunications industry.

Organisations must first apply for approval from ACMA, which requires the organisation to satisfy eligibility criteria. Once approved, the organisation can then apply to register specific Sender IDs on the register.

At the time of writing, the Sender ID Register has not been made mandatory. The Explanatory Memorandum to the legislation proposes two alternatives:

• Under a voluntary model, organisations will not be required to register. However, if an organisation or Sender ID is registered, telcos may be required to verify that any messages that use a registered Sender ID in fact originate from the registered organisation.
• Under a mandatory model, organisations would be required to be registered in order to utilise Sender IDs.

In either case, telcos would be required to either block (ie prevent delivery) of any unverified messages, or append a scam warning to the message before delivering it to the customer.

Whether the voluntary model or mandatory model will be selected remains to be determined by further regulations and/or government directives.

Overall, the intent of the Sender ID Register is to reduce the prevalence of scam activity exploiting the Australian mobile phone network through Sender ID spoofing.