AIT 根源成因、解决方案及其对富通信套件与网络应用程序接口的影响 AIT - The root cause,the Solution and the Implication on RCS and Network APIs

EricssonWhitePaperGFTL-25:000136

February2025

ERICSSON

AIT-Therootcause,the

SolutionandtheImplicationonRCSand

NetworkAPIs

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs2

Content

February2025

Content

ExecutiveSummary3

DemystifyingartificiallyinflatedSMStraffic4

WhyMNOsarenotatfault?5

WhatistherootcauseofAIT?6

Exclusiveagreements7

Ahandfuloftrustedpartners9

Terminationrevenueshareincentives10

Whatisthesolution?11

WhataboutRCSbusinessmessaging?12

WhataboutnetworkAPIs?14

Conclusion15

Authors16

3

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIsExecutiveSummary

February2025

ExecutiveSummary

ArtificiallyinflatedSMStraffic,orSMSpumping,hasbeenalongstandingconcernthathassurgedexponentiallyinrecenttimes.Largeinternationalbrandshavebeensignificantly

affected,withsomedirectlyaccusingmobilenetworkoperators(MNOs)ofbenefitting

fromthisspecifictypeoffraud.WefirmlybelievethatMNOsarenottheperpetratorsofthesefraudulentactivitiesforseveralreasons,whichwillbediscussedlater.However,weacknowledgethatcertainbusinessmodelsadoptedbyMNOscreateanenvironmentthatincentivizessomeactorstoengageinSMSpumping.

Additionally,whilerichcommunicationservices(RCS)aremoresecureandtransparent

thanSMS,theyarenotimmunetosimilartypesoffraud.IfSMSbusinessmodelsaredirectlyappliedtotheRCSbusinessmessagingecosystem,wemightencounterthesameissues.

AlthoughnetworkAPIscandisruptthefraudchainforspecificusecases,suchasone-timepasswords(OTPs),theyunfortunatelycannotaddresstheentireproblem.Consequently,MNOsmustreconsidertheirbusinessandpartnershipmodelstomaintaintheirnative

technologieswithinthevaluechain,preventingbrandsfrommigratingtonon-MNOchannelsandavoidingpotentialregulatoryimplications.

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs

DemystifyingartificiallyinflatedSMStraffic

February2025

4

Demystifying

artificiallyinflatedSMStraffic

Artificiallyinflatedtraffic(AIT)asdefinedbytheGSMA,referstoSMStrafficthatis

generatedforthefraudulentpurposeofgeneratingrevenueassociatedwithitsdeliveryforcertainpartiesintheSMStrafficchain.SMSAITtrafficistypicallydisproportionatetotheoverallamountoftrafficthatwouldbeexpectedfromlegitimateusageoracceptableandreasonablecommercialpractices.VictimsofAITaretypicallylargebrandsintheconsumerspacesubjectedto‘botattacks’againsttheirapplications,suchasone-timepasswordloginflows,notifications,orSMSlinkstodownloadmobileapplicationsduringausersign-up

flow.Largeenterprisesarenotthesolevictimsofsuchattacks;aggregatorsandMNOscanalsoencountersignificantliabilitiesintheeventoffrauddisputes.

TherearemultiplestrategiesforexploitingAITforfinancialgaindependingonthepositionofthebadactorintheecosystemandthespecificattackvector.AITcanbebroadly

categorizedintotwomaincategoriesbasedontheattackvector:Supplychainattacksorrevenueshare-basedattacks.

Supplychainattacksinvolveabadactor,eitherwithinthesupplychainorcollaboratingwithasupplychainpartner.Anattackislaunchedagainstthevictim,whichroutestrafficviathebadactorwithinthesupplychain.Dependingonthelevelofsophistication,trafficmaybe

forwardedtounsuspectingusers,droppedlocally,orinmoreadvancedcases,terminatedlocallyandconvertedintoalegitimateuseractionwithinthevictim’sapplication.For

example,abotmayenteraone-timepasswordtomimicalegitimateend-userandevadedetection.

Revenueshare-basedattackstargetlegitimateservicesofferedbyMNOssuchasnumber

leasingandtermination-basedrevenueshare.Insuchcases,thebadactorobtainsaccesstonumbersornumberrangesbeforelaunchinganattackagainstthevictim.Attackersarethenpaidarevenueshareofterminationrevenuesfromtheirserviceprovider,typicallyaresellerofservicesprovidedbyanMNOornationaloperator.

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs5

WhyMNOsarenotatfault?

February2025

WhyMNOsarenotatfault?

AlthoughtherehavebeendirectaccusationsclaimingthatMNOsareresponsibleforthistypeofAITfraud,thisisamisconception.Therearefourreasonsforthis:

First,itisoftenassumedthatbrandsdirectlyengagewithMNOstosendSMSmessages.However,thisisnotaccurate.Inmostinstances,therearemultipleintermediaries,suchasaggregators,betweentheMNOandthebrand.

Second,theadditionalrevenuegeneratedbysporadicAIThasaninsignificantimpacton

theoverallrevenuesofMNOs,makingithighlyunlikelythattheywoulddeliberatelyengageinfraudwithvirtuallynofinancialbenefit.

Third,itisnotinthebestinterestofMNOstodevaluetheirproductsanddrivebrands

toexplorealternativechannels,suchasWhatsApp,fromwhichMNOswouldnotderiveanyrevenue.However,MNOsandreputablesupplychainpartners,whoindirectlyderivemarginalprofitsfromtheterminationoffraudulenttraffichavebeenaccusedof"willfulblindness"—theactofavoidingliabilitythroughintentionalignoranceofthefacts.

Finally,thereisheightenedscrutinyfromregulatorsandlegislatorswhoseektoprotectconsumersandenterprisesfromharm.ThistrendismovingtowardestablishingadutyofcarewithfinancialandcriminalliabilityforMNOs,inanefforttobreakthefraudulentmoneychain.

6

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIsWhatistherootcauseofAIT?

February2025

WhatistherootcauseofAIT?

Therootcauseoftheissueliesinthecomplexsupplychainmodelinvolvingmultiple

actors,alongwithcertainMNObusinessmodelsthatcreateanenvironmentwheresome

participantsinthevaluechainfeelincentivizedtoengageinAIT.ItisrareforanMNOto

bedirectlyconnectedtoabrand.Typically,anMNOworkswithaselectgroupofpartners

orSMSaggregators,sellingSMStraffictothemonawholesalebasis.Theseaggregators

oftenarenotdirectlyconnectedtothebrandsandmayfurthersellSMStraffictoother

aggregators.Asaresult,therecanoftenbethreeorfouraggregatorsbetweenanMNOandthebrand.Attackersoftendependonthislackoftransparencytoavoiddetectionandevadelawenforcement.

7

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIsExclusiveagreements

February2025

Exclusive

agreements

Recently,MNOshaveincreasinglyadoptedshorterexclusivityagreementsforA2PSMS,

reducingthedurationfromtheinitialthree-yearperiodtojustoneyear.MNOstypically

auctiontheseexclusivitiesthrougharequestforproposal(RFP)processtoaggregators,

wherethosewhowintheRFPbecomethesoleSMSterminationproviderforthespecificMNO.Beingexclusive,thesedealsoftenincludesubstantialminimumcommitments,andthewinningaggregatorisusuallytheonewhooffersthehighestcommitmenttotheMNO.

Onceanaggregatorcommitstoasignificantupfrontcommitment,theymayfeel

incentivizedtodramaticallyincreaseSMSterminationprices—sometimesbyasmuchastenfold—tofulfillthecommitment.Thisdrasticshiftinprice-volumeeconomicspushesmanybrandsawayfromSMStocheaperbutlessubiquitousOTTchannels.Iftheexodusistooswiftandsignificant,theexclusiveaggregatorscouldfindthemselvesinadifficultpositionandmightresorttofraudulentmeanstoreplacetrafficandpreventlosses.

Furthermore,thisissuecascadesdownthesupplychain.Nosingleaggregatorconnects

directlywithallthebrandsworldwidetosellSMStraffic,sotheexclusiveaggregatorresellsSMSterminationrightstootheraggregators,imposingminimumcommitmentsonthemaswell.Anyaggregatorinthevaluechainfacingincreasedpricesandthethreatofincurringlossesmightalsoengageinfraudulentactivitiestostayinbusiness.

Importantly,therearelong-termconsequencestothestrategyofusingsoleexclusive

aggregators.Theincreasedprices,combinedwithAIT,erodethemarketandpushbrands

towardOTTchannels.Oncebrandsleave,itbecomeschallengingtolurethemback,evenifpricesarelaterreduced,asstabilityandtrustintheSMSchannelhavebeencompromisedintheireyes.

8

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIsAhandfuloftrustedpartners

February2025

Ahandfulof

trustedpartners

WhenMNOschoosetointeractwithahandfulofpartners,insteadofexclusivities,similar

issuesmightoccur(albeittoalesserextent).AnMNOoftenhasupfrontcommitmentstoitstrustedpartners.Sincethesepartnerscannotrepresentallbrandsglobally,theyneedto

resellSMSterminationtootheraggregatorsdownthesupplychain,oftenplacingrevenuecommitmentsonthemaswell.TheissuebecomesmoreevidentwhenanMNOselects

trustedpartners,astheaggregatorsthatdon'thavedirectrelationshipswithbrandsdependentirelyonresellers.AITfraudinthisscenariobecomesharderforMNOstopinpoint,as

oftenfraudulenttrafficismixedwithlegitimatetraffic.

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs

Terminationrevenueshareincentives

February2025

9

Termination

revenueshareincentives

InadditiontosupplychainfactorsinAIT,fraudstersalsoexploitlegitimaterevenue-sharingagreementssuchasnumberrangeleasing,andmicro–mobilevirtualnetworkoperator

(MVNO)ormobilevirtualnetworkenabler(MVNE)deals.Likesupplychainfraudscenarios,MNOsmustexercisecautioninvettingandworkingwithtrustedpartnerswhoaredirectlyusingtheirvaluablenumberingandinterconnectassets,asthisdirectlyexposesthemto

regulatoryandlegislativerisks.

ThesimpleapproachforanattackerwouldbetoregisterwithanonlineresellerwhooffersvirtualnumberscapableofreceivingcallsorSMSforwhichtheattackerispaidashare

ofanyassociatedwholesaleterminationrevenue.Theresellerhasinturnleasednumberrangesfromalicensedoperatorunderaterminatingrevenueshareagreement.

Atamoreindustrialscale,attacksoftenspanextensivenumberrangeswhereanattackerhaseitherenteredintoadirectagreementwithanMNOorhasusedanMVNE,which

offerstheabilitytosetupawhite-labeledMVNOwithinweeksusingpre-existingMNO

agreements.Insuchcases,theMNOorMVNEoftenbecomedirectvictimsoffraud,asbadactorsusefakeorstolencredentialstoaccessservices.

Ineithercase,responsibleserviceprovidershaveadutyofcaretotakereasonable

measurestodetectandpreventfraud,includingstrongvettingofrevenueshareusecasesandtrafficmonitoringtodetectsuspiciouspatternsofabuse.Thesignificanceoftrust

betweenanMNOandapartnerorresellerofferingaccesstotheMNO’slicensedassetscannotbeoverstated,astheMNO’sriskexposureismuchhigherinsuchcases.

10

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIsWhatisthesolution?

February2025

Whatisthesolution?

TrustandintegrityintheMNOanditssupplychainpartnersareessentialtoensuringsafe,durablebusinessrevenuesforall.Theindustryhaswitnessedanerosionoftrustinmobilecommunicationsduetothegrowthofspoofing,phishing,andAITattacksastechnologyevolvedintoIP-basedcommunications,enablingwidernetworkaccesswithglobal

interconnectedness.Despitethis,ourindustryhasanopportunitytorebuildtrustthroughsolutionssuchasRCSandnetworkAPIswhichincreasesupplychaintransparencyandbreakthefraudchain.

However,toenablethiswemustlearnfromhistory.Exclusivitydealshavedistortedmarketsandobscuredsupplychainsthroughreselling,enablingbadactorstogoundetected.Such

dealsincentivizefraudandincreasecompliancerisk.Prioritizationofshort-termgains

fromhighinitialcommitmentsoverlong-termmarketresiliencecombinedwithincreasedcomplianceriskduetoweakknowyourcustomer(KYC)controls,createsatoxicrisk

environmentforanMNOoperatingvaluablelicensedassets.

TominimizeAITfraudandensurethelong-termsustainabilityofCSPassetsinthevaluechainwerecommendthefollowing:

1.Avoidexclusiveagreements

2.Choosepartnerswithstrongconnectionstobrands,avoidingresellers

3.Recognizethatunsustainablehighinitialcommitmentsincentivizefraud

4.ImposestringentKYCandethicalstandardsonsupplychainproviders

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs11

WhataboutRCSbusinessmessaging?

February2025

Whatabout

RCSbusiness

messaging?

AsallmajordevicevendorsstartsupportingRCSandRCSbusinessmessaging,the

impactonA2Pmessagingwillbesignificant.RCSoffersrichercontent,suchasinteractivecarousels,combinedwithtrustedbrandregistration.Itoffersbettermonetization

opportunities,suchaschargingbasedonconversationortime,unlikeSMS'sper-messagemodel.Additionally,RCShasaclearpathforevolutionbypotentiallysupportingnew

featureslikedocumentsigningandscreensharing.AsglobalnetworksevolvetowardsfullIMSarchitectures,RCSwilldisplaceSMSmessagingwithinmobilenetworksastheubiquitoussecuremessagingsolution.

RCSbusinessmessagingrepresentsasignificantstepforwardinreducingspamand

mitigatinggreyroutesandintroducesgreatertransparencyinsupplychainroutingbetweenbrandsandterminatingMNOs.However,itisvulnerabletothesamepitfallsandmarket

conditionsasSMSA2P,duetotherisksassociatedwithexclusivitydeals,price-volumeeconomics,andtheprevalenceofresellerslackingdirectconnectionswithbrands.

RCSstructurallymitigatesAITrisksthroughitsMaaP(messagingasaplatform)framework,whichcentralizesagentprovisioningunderGSMA-backedcertificationprocesses.Unlike

SMS’sfragmentedsupplychain(withopaqueaggregatorsandresellers),RCSrequiresall

agentstoundergoidentityverificationandcompliancecheckstoensurelegitimacybeforeintegration.Thiscreatestraceability;everymessageistiedtoacertifiedentity,enabling

MNOstomonitortrafficsources.Additionally,MaaP’sstandardizedAPIsandcentralized

hubsreduceuncontrolledintermediaries,limitingavenuesfortrafficmanipulation.However,ifMNOsbypassthesesafeguardsthroughexclusivitydeals,laxcertificationenforcement,orpoormonitoring,thesystem’stransparencybenefitsdiminish,bringingbackvulnerabilitiessimilartothosefoundinSMSAITfraud.Thus,whileRCS’sarchitectureinherentlyprovides

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs12

WhataboutRCSbusinessmessaging?

February2025

asignificantstepforwardinsecurityandtransparencycomparedtoSMS,itsefficacystillhingesontheMNO’sdiligenceinmonitoringthechainoftrust.

BrandshavehighexpectationsforRCS,hopingthatthistypeoffraudwillbesignificantly

reduced.IfRCSdevelopsareputationsimilartothatofSMS,brandsmayfindthemselves

leftwithonlyOTTchannelsasviableoptions.Therefore,MNOsmustbehighlyvigilantto

maintainthebrandvalueofRCSbyaddressingthepitfallsoftheecosystemwhereAIT-typefraudcanoccur.

AIT-Therootcause,theSolutionandtheImplicationonRCSandNetworkAPIs13

WhataboutnetworkAPIs?

February2025

WhataboutnetworkAPIs?

IntherealmofCAMARA-basednetworkAPIs,themechanismsdiffersignificantlyfrom

thoseofSMSandRCS.AITisoftenfoundintwo-factorauthentication(2FA)usecases.

Fraudstersfind2FAjourneysinmobileapplicationswithaglobaluserbaseandartificiallyinflateSMSandvoicetrafficintheformofOTPsaroundtheworld.

NetworkAPIslikenumberverificationandenhancednumberverificationeliminateanyincentiveforAITbyremovingtherequirementforOTPsduringthe2FAusecase.Numberverificationisanew2FAsolutionthatleveragesthesimcardofamobiledeviceasthe

possessionfactor.Enhancednumberverificationelevatesthesecurityandavailabilityofnumberverificationusinganintegratedtoken-basedsystem.

Moreover,thesenetworkAPIswillincorporateconsentcapturemechanismsforexplicitend-userconsent,furtherdeterringfraudstersfromusingbotstoartificiallyinflateCAMARAAPItraffic.

EvenasnewtechnologieslikeRCSandnetworkAPIsemergeandgaintraction,traditionalOTPsolutionslikeSMSandvoicewillcontinuetobedeployed.Developersandenterpriseswilltransitionandadoptnewtwo-factorauthentication(2FA)solutionsatdifferenttimes,dependingontheirindividualrisktoleranceandlocalmarketavailability.Therefore,MNOsstillneedtoreassesstheirbusinessmodelpracticestoeliminateAITfraud,evenasnew

technologieshelptoaddresstheproblem.

14

AIT-Therootcause,th