New Delhi: India’s telecom operators have flagged to regulators that telemarketers may be routing critical banking SMSes, including transaction alerts, through unregulated channels, posing risks to consumer security, according to two industry executives and one government official aware of the discussions.
Telcos have been observing a decline in SMS traffic from lenders, which could also be denting their revenue from text messaging services.
“Despite the norm that critical banking SMSes to users have to be routed through telecom infrastructure, operators have seen a 50-80% dip in volumes of such traffic across major public sector banks,” said one of the industry executives cited above, adding that the pattern looks more like rerouting or delivery-path substitution than user churn or a decline in communication demand.
Telemarketers bypass telcos
In multiple meetings with the joint committee of regulators (JCoR), which includes the Telecom Regulatory Authority of India (Trai), the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (Sebi), operators conveyed that the number of messages delivered and recorded on telecom networks was lower than the expected volume of SMSes sent by some telemarketers.
This raises two possibilities: either the critical SMSes are not being sent to users, or they are being routed through other channels, bypassing telecom networks. In the former scenario, banks will have to pay even for undelivered SMSes to telemarketers, according to the two industry executives.
Telemarketers are entities engaged by principal entities to undertake outreach to existing or prospective customers through telephone calls and bulk SMSes.
Principal entities, such as banks and consumer goods companies, are typically charged about 7 paise per SMS, including the termination charge.
Telecom operators alleged that after securing contracts from banks, some telemarketers switch SMS delivery from regulated telecom networks to untracked channels to cut costs.
Across public sector banks, 60-70% of expected SMSes are being diverted and not recorded in telcos’ delivery report systems, according to delivery report data shared with the JCoR.
Trai norms require operators to share the SMS delivery report with principal entities in the form of a total count of messages delivered through a system-generated report, and to also make necessary arrangements for cross-verification of the same on a case-by-case basis.
“Telcos have been asked to develop a mechanism for sharing these delivery reports directly with concerned principal entities, including in cases where messaging traffic is routed through or facilitated by telemarketers. Sectoral regulators such as RBI will have more say on how banks should have an arrangement with telemarketers,” the official said. All three people spoke on condition of anonymity.
Mint’s queries emailed to Trai, RBI, Bharti Airtel, Vodafone Idea and Reliance Jio remained unanswered.
Regulatory blind spot
In a presentation to the JCoR, operators claimed certain internet-based apps, phone-based SMS apps, rich communication services (RCS) and Truecaller-style over-the-top (OTT) apps are processing and displaying financial transaction details entirely outside the Trai-regulated SMS ecosystem, said the second industry executive.
To be sure, Truecaller has an SMS reader that displays messages delivered via the telecom network to its users. The platform also has Truecaller Business Chat, an instant messaging service that uses the internet to deliver SMSes.
Mint’s queries emailed to Truecaller also remained unanswered.
“This is a critical regulatory blind spot. Communications over these channels are not governed by the Telecom Commercial Communications Customer Preference Regulations, 2018. They operate without DLT (distributed ledger technology) scrubbing, verifiable customer consent, or lawful interception capabilities,” the second executive said.
“Consequently, highly sensitive financial information, including account numbers, transaction amounts, and beneficiary details, is transmitted across internet infrastructure and, in many cases, routed through foreign platforms beyond the existing telecom regulatory framework,” the executive added.
Telcos also raised concerns about in-phone SMS apps, which they say bypass telco channels for SMS delivery and for sharing reports.
Telcos recommended that they publish all delivery reports for each principal entity on the DLT platform, and RBI guide banks to identify gaps in current communication systems.
They also recommended that the banking regulator ask banks to use these telco-verified reports so they pay for messages actually delivered to subscribers, according to the three people cited above.
“Telcos work under licence, and it is important that such critical communication should be routed through networks for user safety and security. Bank communication through third-party apps could impose risks, as the built-in security is usually not present in those apps,” said telecom consultant Rakesh Mehrotra.