The Australian Communications and Media Authority (ACMA) has taken action against Vonage and Twilio for breaching its SMS anti-scam regulations.
After an investigation, the government agency established that the two CPaaS giants allowed customers to send SMS messages – including sender IDs (i.e. shortened business names) – without making adequate checks that their tech wasn’t being utilized to execute scams.
Moreover, it uncovered that fraudsters had leveraged Vonage tech to send 3,387 scam texts impersonating organizations, including ApplePay, Commonwealth Bank, and Australia Post.
In total, Vonage enabled the sending of 11,780 non-compliant SMS messages.
Meanwhile, the ACMA also adjudged Twilio to have "inadequate" systems to comply with the rules. Yet, thankfully, in its case, there is no evidence that scammers exploited these vulnerabilities.
The agency has now formally directed both businesses to comply with its Reducing Scam Calls and Scam SMS Code, introduced in July 2022.
It will also continue conducting audits, warning telcos that they may face $250,000 fines for compliance breaches and highlighting how battling SMS scams is an ACMA priority.
Doubling down on this, ACMA Chair Nerida O'Loughlin stressed how scammers will continue exploiting the holes left open by such compliance breaches. She stated:
Since these SMS anti-scam rules came into place, Australian telcos have reported blocking almost 257 million SMS scams. But we know that scammers target the weakest links, so it’s vital that every telco has processes that are up to scratch to meet Australian standards.
"As the rules have been in place for over a year now, it's unacceptable that we continue to find telcos allowing scammers to send SMS impersonating businesses domestically."
Both Vonage and Twilio play a critical role here, providing the link between telecom networks and the internet.
These investigations by the ACMA will remind them – alongside their market rivals – that they must prove they're taking proactive measures to comply with the code.
Vonage, in particular, has lots of work to do after it also breached regulations by failing to report how many scam SMS messages it had blocked for the past three consecutive quarters.
Yet, both businesses must now ensure they have sufficient checks in place to ensure customers have a legitimate case to harness sender IDs in SMS blasts.
