Turning Grey into Gold AdaptiveMobile Threat Intelligence Unit s Analysis on Recapturing A2P Messaging Revenue

Transcription

1 Grey into Gold AdaptiveMobile Threat Intelligence Unit s Analysis on Recapturing A2P Messaging Revenue

2 Contents Introduction 3 Industry Overview 4 Debunking the A2P Myths 5 Impact on Carriers 6 The Grey Route Money Flow 7 Regulatory Impact 8 Facing Financial Exploitation 9 Grey to Gold A Detailed Look 10 AdaptiveMobile Grey Route Management Approach 11 2

3 Introduction Application-to-person (A2P) traffic over mobile networks is steadily growing. A recent report from Transparency Market Research states that with the compound annual growth rate of 4.4 percent, the A2P SMS market will be worth $70.32 billion USD by In a comparable report issued by Juniper Research, the research and consulting firm states that A2P SMS will generate significant growth over the next five years as enterprise messaging sees considerable uptake in the form of two-step verification and notification services. The report outlines that user concerns regarding privacy will aid A2P SMS growth with secure message delivery and reliability being key particularly noteworthy as Transparency Market Research explains transactional activities that allow users higher convenience with post-transaction notifications and safety with one time passwords will drive this market in the forecast period. In contrast, carrier SMS revenues are in steady decline, suggesting that carriers are not being effective in monetising this market opportunity. The revenues would appear to be bypassing the carriers balance sheets, however they are still carrying the burden of A2P message delivery to the subscriber. As user concerns regarding privacy grow, so too do the amount of companies looking to safeguard sensitive communications and information. The originating countries and routes taken of SMS alerts for banking transactions, two-factor authentication messages and personal notifications should be of concern to both brands and consumers alike. With an increased need to find the most cost-effective routes, messages containing personal data such as authorisation of a bank transfer using a one-time PIN or providing password reset authentication for an online application are often re-routed through countries with inexpensive international rates. are then at risk of contravening data protection regulations as well as risking a delayed or unreliable delivery; sensitive messages are being compromised by the need to find the most cost-effective routes. This report will provide an overview of the situation carriers are currently facing, how carriers are being exploited financially and the amount of revenue there is to be recaptured in each region of the globe. 3

4 Industry Overview Mobile networks normally provide two different categories of services, consumer services and commercial/wholesales services. Both of these categories generally have different terms and conditions of service. A specific type of SMS service involves sending SMS messages from an application (or company) to a person and is termed A2P for short. The rise of social media networks, cloud services and increase in app sign-ups has fuelled the growth of the SMS grey route delivery infrastructures and usage, to parallel this sector s Freemium or advertisement funded business models. An A2P Grey Route is an SMS sending network that sends commercial SMS messages in violation of the carrier s terms and conditions regarding commercial messaging. It is SMS traffic that enters mobile networks through unauthorised and unbillable channels, transmitting alerts, notifications and marketing messages. Once these SMS grey route infrastructures were created they attracted other brands or SMS aggregators to use them for other services and brands. The benefit being that the cost of sending an SMS was greatly reduced and they were able to retain a higher portion of the payments from customers using their services. Effectively cutting out the carriers from the revenues associated with the service, as they either cannot bill for these messages or can only bill at person-to-person (P2P) rates. The current industry trend driving the increase in A2P traffic is influenced by a range of services that businesses are offering their customers, such as banking and transaction details, insurance claim processing, location confirmation, and medical and appointment reminders. As the industry s addiction to this network grows, unauthorised grey routes become more difficult to track. Introductions of increasingly generous consumer packages for high volume senders, and government-set price caps to encourage competition to some degree have contributed to the loss of A2P service revenues and encouraged the expansion of sending networks both on an international and national basis. Today s mobile carriers are frequently losing potential income due to the SMS marketing and business process messages entering their networks, or originating from their networks. Person-to-Person (P2P) SMS usage is steadily falling mainly due to other messaging applications or social media being used as a replacement, such as imessage, WhatsApp, Twitter and Facebook Messenger. In contrast, A2P traffic is steadily increasing and often in support of these substitute messaging services. 4

5 So why is the A2P market growing? It turns out that SMS is unique. There is no GSM standard mobile phone (smart, feature or basic) that does not support SMS. The service is authenticated in all cases to an individual person or mobile SIM card, services operate globally in real-time and are supported in nearly every country and language. There are billions of devices worldwide with expectations of growth to 9 billion mobile connections by This is the only global method of identification and contact of any specific individual in any network on any device. Enterprises are communicating more with their customers via SMS, and it is here where most major brands have their commercial messages funnelled at the lowest cost. As the A2P message providers search for the lowest cost delivery method traffic is directed through unauthorised channels, and all around the world mobile carriers are losing revenue through unauthorised grey routes. If left un-checked, this will lead to the widespread use of SMS grey routes at the carriers expense. Debunking the A2P Myths Understanding this situation, carriers then need to detect the International and Domestic Bypass traffic in their network (commonly referred to in the industry and throughout this report as Grey Routes) as well as Internal Bypass traffic (including what is known as SIM Banks or SIM Farms). There are several ways to detect this traffic, but first and foremost carriers need to identify the A2P SMS traffic transiting their network and confirm whether this traffic is originating from an unauthorised source. Identification of A2P traffic mixed with P2P traffic can be a challenge for carriers, so techniques such as Active Monitoring have come to light to allow a carrier to generate a specific sample of traffic from an application source. From there they can trace to the sending SMSC and then the sending carrier. The benefit here is that all traffic analysed is guaranteed to be from an application source and avoids the complexities of separating the A2P traffic from P2P traffic; however, it does not provide a comprehensive analysis of the overall network and thus still leaves the carrier vulnerable to exploitations. How can one confirm whether there is an issue on an active network if only a sample of the traffic is analysed? 5

6 Impact on Carriers As SMS continues to be one of the most effective ways for businesses to reach customers worldwide, the impact of the growth of A2P traffic means that carriers are beginning to see pressures on their interconnect margin as well as reducing profitability. AdaptiveMobile has identified the primary areas of revenue loss: 1. Inbound Grey Routes Also referred to as International or Domestic Bypass, traffic is coming in from origins abroad where the traffic is being polluted, so there is a mixture of clean P2P traffic as well as polluted A2P traffic. Carriers may have AA19 Roaming Agreements, from which they ll receive a small compensation from partnering networks. The others are detected as international messages. Once international grey routes are under control, they can move to a domestic service. This is advantageous as it is often faster for companies to reach their consumers through long numbers, as opposed to short codes. 2. Outbound SIM Banks A type of Internal Bypass, SIM banks are increasingly being used inside networks to target national and international outbound service gateways delivering messages through grey routes to national and international counterparts. They bypass the carrier s standard business offerings (that typically use short codes), causing an influx in termination fees for the carrier, particularly in international cases. While there are any number of messages that can be sent through grey routes, the following are the primary categories AdaptiveMobile has identified: A) In-Bound Marketing Messages: B) Notification and Reminder Messages: C) Access & Authorisation Codes: Marketing messages sent from one corporation to many subscribers at no additional interconnectivity cost. Traditionally, these are legitimate messages from valid organisations such as customer notifications from delivery companies, utility companies, financial services, or retail brands. They are often requested by the customer and not spam. Examples of this category include a reminder sent via SMS to attend a medical appointment, or alerting a consumer to the delivery of a package to their home or business. Messaging that comes from companies (such as banks or social networking sites) that use SMS to send access codes and notifications about a specific account. These are not spam as often the receiver has requested this method of communication and it s used as a security feature for any service that requires 2-factor authentication. 6

7 The Grey Route Money Flow There are many large brands today successfully buying bulk volumes of messages from legitimate aggregators and sub-aggregators; however, from the tiering of aggregators acquiring connectivity to other markets, the competition to provide the least expensive option is tight and this is where grey route providers come in to play. As companies seek low-cost delivery, aggregators will often use an Economy option, where features such as control of the sender id, delivered to mobile status reports, local time stamps and speed of delivery are given a lower priority and messages are normally sent via indirect routing. Grey routes manifests themselves to the carrier as an increase in international traffic. With this increase from international sources, carriers typically strike AA19 agreements providing a revenue stream where there would normally be only costs. The visuals below demonstrate the flow of money when brands send bulk messages through aggregators. Without any controls in place, carriers will struggle to recapture aggregation Other mobile operators receiving this revenue Enterprises and may receive no moremessage than 10% of the revenue opportunity. services Enterprises Message aggregation services Legitimate Routes international grey route traffic Aggregators & Sub-Aggregators Grey Route Providers Aggregators & Sub-Aggregators Grey Route Providers Other mobile operators receiving international grey route traffic Without Any Controls Legitimate Routes Non AA.19 Without Any Remaining 2000 Controls Operators AA.19 ~10 to 20 Opertators You get no messaging revenues with no Non AA.19 AA.19 You get minimal revenues with ~10 to 20 Remaining 2000 Opertators Operators 0.1-1c per message $0 - $1M+ p.a. You get no messaging revenues with no You get minimal revenues with 0.1-1c per message $0 - $1M+ p.a. Figure 1: Grey Route Money Flow without any controls Enterprises Message aggregation services Other mobile operators receiving international grey route traffic Enterprises Message aggregation services Other mobile operators receiving international grey route traffic Legitimate Routes Legitimate Routes Aggregators & Sub-Aggregators Grey Route Providers Aggregators & Sub-Aggregators Grey Route Providers With SMS Firewall Grey Route Controls Direct With SMS SMS Firewall Sales FW ~3 to 4 Grey RouteVendor Controls Most of your enterprise relationships lost Direct Messaging revenues shared with Sales SMS FW SMS FW provider ~3 toyou 4 receive only 50%Vendor $1M - $2.5M+ p.a. Most of your enterprise relationships lost Messaging revenues shared with SMS FW provider You receive only 50% 7 Figure 2: Grey Route Money Flow using an SMS Firewall Vendor $1M - $2.5M+ p.a. Without Any Controls Non AA.19 Without Any Remaining 2000 Controls Operators AA.19 ~10 to 20 Opertators You get no messaging revenues with no Non AA.19 AA.19 You get minimal revenues with ~10 to 20 Remaining 2000 Opertators Operators 0.1-1c per message $0 - $1M+ p.a. You get no messaging revenues with no You get minimal revenues with 0.1-1c per message $0 - $1M+ p.a.

8 With a basic SMS Firewall, carriers have a greater opportunity (~50%) to recapture this revenue as they have the opportunity to develop direct relationships with those brands that can be identified through the basic perimeter approach. Regulatory Impact There is also a concern around the government-set price caps put in place to encourage competition in the marketplace. Intending to level the playing field for SMS senders, these regulations are (in part) contributing to the loss of A2P service revenues and encouraging the expansion of sending networks on both an international and national basis. There is a growing need to differentiate between A2P and P2P messages to ensure that carriers are receiving a fair amount of revenue and that aggregators are not abusing the P2P messaging channels. Without a formalised distinction between P2P and A2P traffic, messages will likely continue to be funnelled through the least expensive routes, depriving carriers of additional revenue. 5 Outbound National Grey Routes SIM Bank Service Gateway 6 Outbound International Grey Routes SIM Bank Service Gateway Other National N/ws OpCo Cost National SMS Termination 2 Inbound International Grey Routes From AA19 Partner International OpCo s Operator Network 3 Inbound National Grey Routes From National OpCo s (Long numbers NOT shortcodes) 4 Inbound VASP (SMPP) From Partners Traffic which does not conform to aggred services / content / destination 1 Inbound International Grey Routes From International OpCo s Figure 3: Areas of A2P SMS Bypass Fraud 8

9 Facing Financial Exploitation Networks are constantly at risk from security threats and technical exploitations, but the financial exploitation arising from a lack of A2P messaging protection leaves significant money on the table. Of the two areas of revenue loss mentioned previously in this report, 67% come from international routes and the remaining 33% are national routes from all over the world, making grey routes a global issue. Countries are increasingly integrated and connecting with different countries; for every interconnect there is a risk that grey route traffic is passing through. The below is an anonymised excerpt of data collected and analysed by AdaptiveMobile s Threat Intelligence Unit that demonstrates the significant revenues to be recaptured once AdaptiveMobile s Grey Route Controls are put in place North American Carrier 2 South American Carrier 3 African Carrier 4 Asian Carrier 5 Asian Carrier Type of Grey Route: Outbound International SIM Banks Annual Revenue Opportunity: $600,000 USD Type of Grey Route: Outbound International SIM Banks, Inbound International Grey Routes, Inbound National Grey Routes Annual Revenue Opportunity: $2,700,000 USD Type of Grey Route: Inbound International Grey Routes, Inbound National Grey Routes Annual Revenue Opportunity: $44,400,000 USD Type of Grey Route: Inbound International Grey Routes, Inbound National Grey Routes Annual Revenue Opportunity: $21,400,000 USD Type of Grey Route: Inbound International Grey Routes, Inbound National Grey Routes Annual Revenue Opportunity: $1,500,000 USD 9

10 Grey to Gold A Detailed Look Taking a deeper look at this business case, we uncover the true value for carriers worldwide. In 2012, one of the largest mobile carriers in Africa was experiencing frequent revenue loss due to SMS advertising and business process traffic entering their networks through unauthorised grey routes. The carrier was primarily receiving three types of grey route messages: 1) Inbound Marketing Messages. In this particular case, the top five sources of inbound interconnect traffic were banks using SMS to provide their customers with bank transaction notifications. 2) Competitor Messaging. Many roamers received messages requesting that they switch carriers should they be looking for a stronger network. Hello. Welcome to [country]. Feel free to roam on [competing carrier], one of the strongest networks in Africa. Enjoy your stay and call us on [contact number] for any assistance. 3) Access & Authorisation Codes. Account verification was the third type of message being sent through grey routes in this network. Examples include national banks and major social networking websites. Due to the strength of an existing relationship, the African carrier approached AdaptiveMobile to look for a solution to this challenge. After deploying AdaptiveMobile s Messaging Security Solution, they were able to identify and shut down these three main classes of grey route traffic and realise in excess of 3.7 Million USD in revenue each month. The protection of subscribers and carrier brand image ensured by AdaptiveMobile led to a significant decrease in the amount of customer complaints and billable time handling concerns. Furthermore, this deployment identified a new revenue stream in a vertical market for Bulk SMS over signalling, which the carrier is launching with high-profile partners; and, the identification and blocking of messaging traffic from competitors targeting roaming and high ARPU customers provided a sizeable increase in data and revenue traffic from roaming users. Upon a more in-depth analysis of properties in the carrier group, it was determined that the total potential revenue to be recaptured is $316,575,000 USD. Because of AdaptiveMobile s unique and proven solution, a system has been put in place to address all ongoing and future threats to the carrier and to its subscribers. Aside from the financial benefits, there is a very strong sense of partnership between the African carrier and AdaptiveMobile as they continue to work together to ensure maximum revenues. 10

11 AdaptiveMobile Grey Route Management Approach As is evident through the above figures, AdaptiveMobile works with the carriers worldwide to recapture a significant amount of revenue per annum. In any one network, AdaptiveMobile measures between brands actively using grey routes to send messages on a regular basis. The banking industry, retail industry, utility industry, internet brands and online services all face the same challenges in terms of requiring guaranteed delivery, ensuring compliancy, needing to ensure protection for customers and have the confidence that carriers are being appropriately compensated for the delivery of their traffic. Identification of A2P traffic mixed with P2P traffic can be a challenge for the operators and a common approach to dealing with grey routes is for carriers to strike AA19 agreements in order to receive some sort of compensation for these messages. However, this action only increases the cost at the originator which is then passed on to the grey route, encouraging grey routes to find a different, less expensive origin from which to send messages. Carriers cannot be expected to chase AA19 agreements with all partners, and the limitations involved with types of A2P Bypass monitoring create additional vulnerabilities in the network for grey routes to exploit. AdaptiveMobile uses content fingerprinting and analytics not source filtering to assist in determining the type of content that travels through a grey route, not just the origin. AdaptiveMobile has also detected numerous SIM Banks within analysis of carrier networks. Normally there are anywhere between SIMS within one SIM bank and they are effectively managed to keep the volume sending under the detection thresholds of fraud systems inside carriers. These SIM banks send between seventy-five and ninety-two messages per day well within a legitimate amount of any normal SIM card. AdaptiveMobile s research has determined that many of these SIM banks hold between fifteen and twenty SIMs on reserve, so if one is blocked the controller can simply continue their activities through the remaining SIM cards. Carrier networks typically take 24 hours between detecting a SIM bank and disabling the sending device. These 24 hours provide ample time for senders to make thousands of dollars before moving on to a different network. The standard perimeter approach (i.e. SMS firewall and GT blocking) is not effective in this case as it does not commonly see on-net originating traffic and volumetric do not work in protecting against this sort of content. AdaptiveMobile s content filtering approach is crucial in ensuring carriers are not exploited and receive the maximum revenue possible within each individual situation. 11

12 Enterprises Message aggregation services Other mobile operators receiving international grey route traffic Aggregators & Sub-Aggregators Grey Route Providers Legitimate Routes With AdaptiveMobile Grey Route Controls With SMS Firewall Grey Route Controls Without Any Controls Direct Sales Most Enterprise/ Approved Aggregator Direct Sales ~3 to 4 SMS FW Vendor AA.19 ~10 to 20 Opertators Non AA.19 Remaining 2000 Operators Your enterprise relationships protected You get maximum margin + all revenue through direct sales 2-10c per message $5M - $8.5M+ p.a. Most of your enterprise relationships lost Messaging revenues shared with SMS FW provider You receive only 50% $1M - $2.5M+ p.a. You get no messaging revenues with no You get minimal revenues with 0.1-1c per message $0 - $1M+ p.a. Figure 4: Grey Route Money Flow using AdaptiveMobile s Grey Route Controls AdaptiveMobile uses Market Lock-Out to control all inbound traffic to block commercial and A2P traffic from unprofitable sources, steering it through available approved routes from specific aggregators that provide better revenues. They also use Legitimate Route Pollution Cleansing which selectively blocks messages from certain brands, services, and applications, while allowing P2P to continue to flow on the same route. Finally, AdaptiveMobile uses Premium Brand Pick Off providing information in such a way that carriers are able to identify and address the high-value brands that are sending messages through grey routes. The implementation of AdaptiveMobile s Grey Route Controls has a significant financial impact on carrier networks. Aside from the financial benefits, there is a strong partnership between the carrier networks and AdaptiveMobile, complementing their technical expertise. Because of the Company s unique and proven solution, carriers are able to quickly identify and update their security measures, thus protecting themselves from financial exploitation and, most importantly, protecting their subscribers. 12

13 About AdaptiveMobile AdaptiveMobile is the world leader in mobile network security protecting over one billion subscribers worldwide and the only mobile security company offering products designed to protect all services on both fixed and mobile networks through in-network and cloud solutions. With deep expertise and a unique focus on networkto-handset security, AdaptiveMobile s award winning security solutions provide its customers with advanced threat detection and actionable intelligence, combined with the most comprehensive mobile security products available on the market today. AdaptiveMobile s sophisticated, revenue-generating security-as-aservice portfolio empowers consumers and enterprises alike to take greater control of their own security. The Changing Face of Mobile With the explosive growth in mobile data usage, consumers and enterprises alike are increasingly relying on the mobile device as the trusted hub of their connected social and business networks. As applications proliferate and devices become ever more sophisticated, the industry is witnessing a step change in device connectivity and usage, with the boundaries blurring between the PC and a mobile handset. The mobile device has never looked so different, or been more important. Protecting Your Network...not just individual services As the boundaries between devices fade, so too, is the relevance of traditional approaches to mobile security. Point security solutions designed to combat threats at a handset level or to specific elements of the network are no longer proving adequate. Threats are becoming increasingly sophisticated and are designed to scam, abuse, defraud, and deliver spam across all services on a device. Compound threats exist and create serious consequences for subscribers; such as an that triggers a text message which in turn prompts a voic call to a satellite phone. With increased connectivity and smarter devices there is a real need for a smarter approach to protecting your subscribers. The AdaptiveMobile Difference AdaptiveMobile is the only mobile security company offering customers solutions designed to protect all of the services on the network. With our deep expertise and unique focus on network security, we continue to lead the market, a reason why many of the worlds leading security and telecom equipment vendors have chosen to partner with us. Our mission is to provide a safe and trusted mobile experience for consumers and enterprises worldwide. Head Office Ferry House, Lower Mount St, Dublin 2. Contact: sales@adaptivemobile.com Regional Sales Contact Numbers US, Canada, Latin America Sales: UK Sales: Middle East Sales: Africa Sales: Asia Sales: European Sales: Regional Operational Support Contact Numbers UK: France: Ireland: India: US, Canada: LATAM: