Spoof proof: How the new SMS Sender ID Registry prevents phishing

LEGAL BRIEFING Spoof proof: How the new SMS Sender ID Registry prevents phishing

Phishing remains a huge problem, with reported incidents up to 5,020 within four years.

It is the end of the line for SMS scammers in Singapore as Infocomm Media Development Authority (IMDA) rolled out a new SMS Sender ID registry (SSIR) that can block spoof messages “upfront and at source” This means that non inclusion in this new ID registry will automatically prevent spam messages that could be used for phishing.

Legal experts from Rajah and Tann and Drew & Napier LLC told Singapore Business Review that the IMDAdeveloped registry works better in ensuring businesses and organisations in Singapore are spoof proof as it takes a “more proactive” approach towards phishing.

The previous registry was discontinued on 7 March. It had a “blacklist-based” approach, wherein businesses and organisations would register their SMS sender ID, and a blacklist of lookalike SMS sender IDs would be circulated to SMS aggregators for automatic blocking, according to Lim Chong Kin, Head of Telecommunications, Media & Technology Practice at Drew & Napier LLC.

This approach, however, did not work efficiently in preventing phishing scams as it was “confirmation-based” and users still received spoof messages, according to Rajesh Sreenivasan, Head of Technology, Media and Communications for Rajah & Tann.

Lim explained that the reason why spoof SMSes were still delivered to some users is that, “potentially suspicious messages originating from non-approved aggregators would still have to be investigated before being added to the blacklist.”

“This method relied on businesses and organisations’ specifying their protected SMS sender IDs, as well as the approved aggregators authorised to send SMSes on their behalf,” Lim added.

“Under the new registry, which adopts a ‘whitelist-based’ approach, companies can register their protected SMS sender IDs against their Unique Entity Number (UEN). Telcos and SMS service providers will be required to check SMS senders against the registry, and SMSes sent under a registered sender ID will be blocked when the sender’s details do not match the registry’s records,” Lim explained.

Motivations for registering

If OCBC losing $13.7m due to phishing scams is not enough reason for businesses to be convinced to jump on board the national registry, Lim told them to at least do it to protect consumers.

Lim added that businesses who will register in the SSIR will also see a boost in consumer confidence and brand reputation, since the registry will provide them credible protection against the likelihood of their sender IDs being misused in SMS scams.

Sreenivasan, for his part, warned that businesses who wish to use SMS but did not conduct “baseline protection” such as registering at the SSIR can face significant liability when a breach comes up.

“It is a baseline corporate governance requirement for companies to have done this, because, without this registration, you’re facing potentially maximum liability for not even doing the minimum to protect your users from that number being spoofed,” the Rajah & Tann expert reiterated.

As of April, about 25 organisations have registered about 1,000 protected SMS sender IDs in the registry.

When asked about plans to make the SSIR mandatory, Sreenivasan said doing so would be a “welcome move,” and a “necessary next step.”

“In Singapore, as in many other countries, businesses often cannot justify the budget for such registrations unless they are statutorily mandated because it incurs costs and companies need to be financially prudent,” Sreenivasan said.

“There are some arguments that this may increase the cost of doing business, but I think those arguments are misplaced because the cost is not in any way prohibitive when compared with the potential risk of not using the SSIR,” he added.

Strengthening SG’s data protection system

More than helping businesses avoid the risk of financial losses due to phishing, the SSIR also ensures that the trust levels of consumers in Singapore’s data protection system remain high, Sreenivasan said.

With a high level of trust from consumers, Singapore is on its way to becoming a model state for digital trade and digital economy.

“This is part of a larger series of steps that [the] government is taking to maintain and ensure the high cybersecurity trust levels for e-commerce and digital trade in Singapore,” he added.

Lim Chong Kin

Rajesh Sreenivasan

Cost is not prohibitive when compared with the potential risk of not using SSIR

SSIR ensures that the trust levels of consumers in Singapore’s data protection system remains high

How businesses can utilise Big Data to their advantage

Utilising data allows processes to be more automated, which leads to increased productivity and simplified operations.

As industries enter a new period of digitalisation in the workplace, the rising demand for tech skills for Industry 4.0—which focuses heavily on automation, data, and the Internet of Things (IoT)—also accelerates this movement. This signifies how the future of work will never be the same and will continue to evolve.

As technology is integrated into various industries, processes will be more automated to simplify lives and increase productivity, whilst heavily relying on data. This could range from automated cleaner robots and patrolling robots for physical manual work, to automation and conversion of data for desk work.

As such, companies are now relying on big data to improve business operations. It has also led to the high demand for tech jobs and opportunities as companies aim to undergo this trend.

For Lai Shumin, Data Analytics Trainer at tech educator platform Smartcademy, the data boom the past few years has inadvertently enabled the collection of massive amounts of data for organisations.

She noted that these companies can now tap into collected data and turn it into insights to improve and enhance their current business processes and offerings. This enables them to identify any bottlenecks or critical paths in their business processes. Data analytics insights will pave the way for informed decisions on improving workflows and practices within companies.

“I think companies should view these technologies as enablers. They can start by identifying pain points within the firm, or bottlenecks that they would like to work on. From there, they can decide how technology can be harnessed to improve these processes,” Shumin said.

With these advantages, companies can automate existing manual and tedious processes to allow for an easier data collection, which will then lead to a more optimised process.

Companies are also now challenged with finding the right talent to employ these technologies. The trainer advised companies to either hire the right talent or upskill their existing employees to be equipped with the right skills.

“We are slowly moving towards a seamless, fully automated world, which will generate an impending surge in data availability. This will open up endless possibilities and potential for employees and businesses,” Shumin said.

Whilst she acknowledges that finding the right talent is not an easy task, businesses should also take the lead in encouraging employees to upskill through offering corporate upskilling and training courses.

“They can design new competency frameworks to map out, restructure, and overhaul the skills and capabilities of their employees every once in a while, and sufficient resources and budget should also be allocated for employee upskilling whilst tapping into available Government schemes,” Shumin said.

Smartcademy offers proper training and education to help out companies in this regard.

As one of Singapore’s leading training providers for in-demand tech skills and career/workforce transformation, Smartcademy offers short but impactful courses related to data analytics and in-demand technologies. It allows for greater flexibility to those who are unable to commit full-time as most of its courses are held on weekends and can be completed in a month.

At the same time, its beginner-friendly courses are tailor-made to include industry-relevant projects and case studies to allow for well-rounded exposure and practical learning. There is typically at least one trainer and a teaching assistant present from the start to the end of the course for extended guidance.

Smartcademy’s students come from different walks of life, ranging from fresh graduates to mature learners. It is common for our students to land jobs relating to Data Analytics after completing Smartcademy’s course even though they graduated from an entirely different major.

For Shumin, these success stories are true testaments to demonstrate the importance of upskilling and expanding one’s skill sets.

“Ultimately, upskilling is not a one-man show. It boils down to the mindsets of both employers – in taking charge of employee learning and encouraging them, and working professionals—in taking charge of their own development and maintaining a positive and open mindset toward lifelong learning,” she said.

Smartcademy offers a range of beginner-friendly, in-demand, and IBFaccredited courses in Data Analytics, Blockchain, Digital Marketing, UX Design, and Design Thinking. Eligible Singaporeans/PRs can enjoy up to 90% in IBF funding support* and offset the remaining course fees via SkillsFuture Credits.

October 2022 intake is closing soon – apply now: https://bit.ly/3CJRS0r

Lai Shumin, Data Analytics Trainer, Smartcademy

We are slowly moving towards a seamless, fully automated world, which will generate an impending surge in data availability. This will open up endless possibilities and potential for employees and businesses