Business SMS Now Requires Registration

Introduction

Any communications medium is subject to misuse by marketers and scammers. The greatest abuse, of course, is seen where the cost to contact individuals is minimal, such as with e-mail or text messaging. When providers of these services deem it enough of a problem for them, they tend to take action to clamp down.

The battle against junk e-mail has been long and arduous. Laws were passed, an anti-spam software industry was created, and other new technologies introduced (such as DMARC) to impede the spammers. The battle continues to this day, as you are likely well aware.

Spam via text messaging can also be a problem, and as a result, a consortium of mobile phone service providers recently endorsed new procedures to control messages sent via SMS, the text messaging system natively supported by all cell phones. If you use SMS for your business, this may or may not affect you, regardless of how few messages you send. Whether it affects you depends on the service provider you use. In short, if applicable, the new procedure requires you to submit information about your business and your SMS policies for approval, otherwise SMS messages may be blocked.

The deadline for this registration was originally March 31, 2023, but that was such short time from when it was announced in January that it was soon delayed until September 1, 2023. This was advertised as a "hard deadline", but since then, it's unclear which carriers did go ahead and block any unregistered business SMS.

If you sign up for new service or acquire new numbers with your existing service, you might need to register each new or transferred number. If you haven't changed providers since before the registration deadline and rarely use SMS, but you didn't register, it's possible your SMS stopped working and you didn't notice!

The next section describes some interesting background on this issue; if you'd like to jump to what you need to know as a business owner who wants to use text messaging, click here to go to Business Registration.

Background

SMS (Short Message Service) is a data transmission system that mobile service providers implemented in the early 1990s, long before many people had cellular phones, let alone smart phones with regular Internet access. Originally it was used mainly with alphanumeric pagers, which could receive but not send.

Cellular phone service companies easily adapted it to work over their networks, and then between customers of different providers by setting up communications gateways between them. If you're old enough, you might remember evaluating how much you would pay for so many text messages in your cellular plan. Back then, it certainly did cost money to send them, and the only way to do it was by typing on your cell phone.

Soon enough, businesses looked for ways to send automated text messages, especially as unlimited (or nearly so) plans became available. A GSM modem, attached to a computer, would communicate directly with the cellular towers as if the modem were a cell phone, using a SIM card associated with an active cellular phone service account. The business could run software on the host computer to send automated text messages.

Shortly, cellular service providers offered the ability to submit text messages into the SMS system via the Internet, eliminating the need for the initial transmission to use the cellular network. The cellular provider would then deliver it normally—to the recipients' phones via SMS over cellular. This allows many more messages to be sent per minute than sending via a GSM modem. Setting up and maintaining such a system is expensive and complicated, though, so individuals and small businesses would not typically subscribe directly to this. SMS gateway companies appeared as intermediaries, offering businesses the ability to sign up, get assigned a cellular phone number, and then send automated and/or mass texts from that phone number using the web console of the SMS gateway provider, or through automation on the customer's application servers.

Some gateways are mainly marketing companies, and offer their SMS gateway service as part of an overall CRM package.

Others offer SMS gateway services as part of a general business phone system (with auto-attendants, phone tree menus, voice-mail, ring groups, extensions, etc.). RingCentral and 8x8 are examples of such providers. Depending on what service plan you sign up for, both allow sending automated text messages, at rates greater than could be done manually.

As far as limiting spam, cellular service providers had established rate limits from the beginning. To prevent complaints by recipients, especially for customers who were charged both for messages sent and received, accounts that sent too many messages could be cut off or billed high overage rates; providers for recipients who are getting bombarded with too many messages might block or rate-limit the sender.

As demand for automated messaging grew, an early effort to standardize management was created via introduction of SMS Short Codes. This is a numbering system separate from the set of ten-digit regular telephone numbers, which enabled service providers to manage routing, capacity, quotas, and billing separately, for the purpose of mass texting at very high volumes. You've seen them before—they were five digits at first, and later six. Businesses could sign up for a Short Code and pay predictable fees to send or receive thousands or millions of messages a day.

Automated text messages, whether Short Codes or a regular phone number, have been used for:

• Appointment reminders
• Subscribing to services such as daily inspirational quotes, ringtone download links, or sports scores ("Send 'DODGERS' to 44636")
• Voting (think American Idol even back in 2003)
• Signing up for special offers (by sending a keyword, for example)
• Customer feedback
• Password reset links
• Chatbots

Short Codes helped manage spam, as businesses had to go through a very involved vetting process before they could use one. Yet as more ordinary ten-digit phone numbers are being used to send automated SMS, spam has been on the rise. Legitimate marketers who use ten-digit numbers will offer recipients the ability to unsubscribe in order to comply with the law, and any legitimate SMS gateway company will require their customers to honor opt-outs (or handle unsubscribe requests automatically). But thousands of spammers who flout the rules, and straight-up scammers, lately have been sending, in the aggregate, hundreds of millions of unwanted messages per day.

Business Registration

What happened

To reduce spam sent via SMS, the major cellular carriers in the United States recently agreed to:

• Track the SMS gateways that allow customers to send SMS via programmatic automation (dubbed A2P messaging);
• Create a new system similar to Short Codes, called the 10 Digit Long Code (10DLC), with SMS messages routed and managed separately from ordinary phone numbers (voice calls will work the same as before);
• Convert the phone numbers used for texting by A2P-enabled SMS gateways to 10DLC numbers;
• Require the end user of each and every 10DLC number to register with a newly formed third-party organization, called The Campaign Registry (TCR);
• Require the end user to provide acceptable information on what is the intended use of A2P messaging, and how consent and unsubscribe requests will be managed, for registration to be approved;
• Once a certain deadline is reached, block any messages coming from A2P providers from numbers that are not registered and approved.

The 10DLC system was launched around 2021, by the way, but each service provider implemented registration, use policies, volume limits, monitoring of traffic, surcharges, etc., on their own. The centralization of the system under TCR, and the requirement that all customers of A2P-capable SMS providers must register with TCR, were announced in January 2023.

Who must register

Using SMS for business purposes doesn't necessarily mean you must register. As described above, the requirement to register is based on who the SMS service provider is, specifically whether the provider could support A2P messaging. If your phone system is with a business VOIP provider (Internet hosted), and your employees use a mobile app for text messaging using their business phone number, you will most likely need to register with TCR to continue texting past the deadline. If you log in to your provider's console and see mention of TCR or A2P-10DLC, now you know what this is about.

Using a cell phone and its built-in SMS capabilities for business purposes on your Verizon, AT&T, or T-Mobile number does not require TCR registration, even if you have hundreds of lines billed to your corporation, since automated messaging isn't possible through cell phone service accounts with these providers.

Also, Google Voice is not subject to TCR registration, which might be surprising since many sole proprietors use it to communicate with clients via SMS, and it is Internet-based. However, if you look at the web or mobile apps closely, you'll see that there is no way to automate text messaging using Google Voice. You must manually type each message, same as on an ordinary cell phone. And if you were to try using the many software automation interfaces in the Google Cloud system to automate Google Voice, once Google notices, your account might be cancelled, as automating text messages is explicitly against the terms of use set by Google.

Microsoft Teams, which offers the ability to include individuals in group chats through SMS, is similarly unaffected.

Finally, messaging through closed proprietary apps, such as Telegram, Facebook Messenger, WhatsApp, etc., are not affected by this, as by themselves they only communicate with each other via the Internet using the app publisher's systems and protocols (not SMS), which are subject to their own rules for rate limiting and spam.

How to register

Registration is done through your phone service provider, not directly with TCR. So, your experience may vary, depending on how well designed your provider's web page is for inputting the information needed for registration. Much of this was set up haphazardly, so errors have been common. Also, note there is a small fee for registration with TCR, and an annual fee to sustain registration, which your provider will pass along to you.

If your provider says you must register, there unfortunately isn't currently a way to opt out, even if you never use A2P messaging, unless you change providers. That is, since RingCentral, for example, offers high-volume A2P packages, all their customers must register, because even if you do nothing but manually type SMS messages once in a while, the fact is any day you could add on an A2P package to your RingCentral subscription. Theoretically a provider such as RingCentral could separate customers with A2P capability from those without, and have only the A2P numbers converted to 10DLC, but when considering the administrative complexity and ways the system could be gamed, it's understandable the consortium of cellular phone companies doesn't allow for this.

Even if you're a single person with one phone number with RingCentral or 8x8, they will make you register. You'll be asked to provide a "brand" (meaning your company name, or the product that you would market), describe each of the "campaigns" (or "use cases") you might engage in (such as direct marketing, customer feedback surveys, sweepstakes, etc.), and provide sample messages. As an individual or very small business, it might be difficult to figure out what you're supposed to put in there, especially when it demands that you input the verbiage of notifications about how to opt in and opt out of text messages, when all you ever do is send ordinary conversational messages to people you know. And if you seem to blow off the requirements in what you type when filling out the registration form, your campaign will be rejected, and you might be forced to wait a while before registering again.

Most use cases will be approved without any vetting of your business, especially if you specify that very few messages will be sent. Some use cases, such as for charity fundraising, running a sweepstakes, or elementary schools, will require vetting of your organization.

Additional considerations

By registering with TCR and using 10DLC numbers for texting, the content of your messages may be subject to review as they pass through the 10DLC system, to audit compliance with your approved registration. Of course, SMS is generally not encrypted and should never be considered a secure communications medium anyway. But the fact that registering with TCR involves consent to this monitoring means your company should review its information security policy to determine whether changes might be required due to this new factor for registered numbers. For example, you might require employees to use unregistered numbers (such as a number tied to a physical cell phone) for two-step verification systems that rely on SMS for one-time authentication codes or password reset links, and only use your registered numbers for customer interaction.

It is also now more important that someone in your company monitors administrative notifications from your phone service provider, in case there are any changes in requirements, allegations of abuse, or other problems with the status of your TCR registration, so these can be addressed before any kind of penalty fee might be imposed or texting disabled.

Call to Action!

If you use SMS for business and you're not registered (or you're not sure), contact J.D. Fox Micro.