A2P SMS Security Guide: Registering Senders and Protecting Your Brand from Smishing

Every organisation that texts its customers is teaching them what a genuine message looks like, and every gap in how it registers, sends and links those messages is room for a smishing campaign to copy it. Application-to-person (A2P) SMS now runs through registration regimes: US 10DLC brand and campaign registration through The Campaign Registry, carrier rules built on the CTIA Messaging Principles and Best Practices, and national sender ID registers in Singapore, the United Kingdom and, from 1 July 2026, Australia. This guide covers the sender side: how to register brands, numbers and sender IDs so they are hard to impersonate, how to design messages customers can verify, how to protect the messaging platform account itself, and how to detect and respond when your brand is spoofed. It is written for security, fraud, marketing operations and customer communications teams. Operator-side filtering and consumer advice are covered in the Scam Prevention in Telecoms Guide and the Vishing and Smishing Guide.

Key takeaways

• Registration is a security control, not paperwork. 10DLC brand vetting, The Campaign Registry's Authentication+ check and national sender ID registers exist to stop others sending as your brand, so complete them for every route.
• Consistency is what customers can verify. One registered sender per use case, one owned short domain and a fixed message style give customers and filters a pattern that look-alikes break.
• Links are the weak point. CTIA guidance says links must not hide the sender's identity and that shorteners should use domains dedicated to the sender; public shorteners teach customers to trust links they cannot read.
• The messaging account is a high-value non-human identity. API keys and console access for your messaging provider can send under your registered brand, so treat them like production secrets.
• Plan for spoofing anyway. Registration narrows abuse but does not end it; monitor reports, keep a takedown and customer notice playbook ready, and use do-not-originate for numbers that never send texts.

How A2P sender identity works by number type

The sender identity a customer sees depends on the number type and the country. The CTIA Messaging Principles and Best Practices (May 2023) describe the US options: 10-digit NANP numbers that support SMS, MMS and RCS, common short codes of five or six digits for high-volume traffic, and toll-free numbers (800, 888, 877, 866, 855, 844) that can be text-enabled only with the toll-free voice subscriber's authorisation. Many other countries allow alphanumeric sender IDs, a brand name in place of a number, which is exactly what smishers imitate.

For one-time codes and authentication texts, which carry their own risks, see the OTP security guide.

10DLC registration done securely

The Campaign Registry (TCR) describes itself as an independent reputation authority chosen by mobile network operators to collect brand and campaign data for A2P traffic on 10DLC. Businesses do not register directly: a campaign service provider (CSP), usually the messaging platform, submits brand and campaign details, and connectivity partners and direct connect aggregators review campaigns before carriers such as AT&T and T-Mobile deliver them. TCR says any business using 10DLC to text customers or employees must register, that it does not itself approve campaigns, and that review can take one to four weeks.

Authentication+ for public company brands

TCR introduced Authentication+ on 17 October 2024 to combat brand impersonation and fraud such as smishing and spoofing. It is mandatory for all new and existing public for-profit brands registering for 10DLC. TCR sends a verification email to a brand representative's business email address (personal and group addresses are not accepted); the representative confirms and enters name and title, and the brand moves to VERIFIED, which is needed to register new campaigns. The email expires after seven days and can be resent for up to 30 days, after which the brand must be resubmitted. The check also runs again when a brand is revetted after an update. TCR has said it will extend Authentication+ to other business types.

Security decisions in the registration

• Who owns the brand record: name a business contact whose mailbox is monitored and tied to the corporate domain, because that address now controls verification. Move it when people leave.
• Who can register campaigns under your brand: agencies and software vendors may register on your behalf. Keep a list of every CSP and agency authorised to send as your brand, and ask each for the campaign IDs they hold.
• Campaign scope: register narrow use cases (account notifications, delivery updates, marketing) rather than one broad campaign, so a compromise of one sending path does not inherit every permission.
• Sample messages: the samples you submit become the baseline reviewers compare against. Use your real format, owned domain and opt-out wording.
• Do not spread traffic: CTIA guidance says senders should not spread messages across many numbers or short codes (snowshoeing). Besides breaching carrier rules, spreading traffic makes your genuine sending pattern harder for customers and filters to recognise.

Sender ID registers outside the US

Alphanumeric sender IDs are the most direct brand impersonation vector, and governments are moving from voluntary protection to mandatory registration. The table shows the regimes confirmed from official sources as at November 2026.

Registration has an operational side effect worth planning for: once an ID is protected, any route you forgot to authorise will also be blocked or labelled. Inventory every system that sends SMS, including marketing platforms, appointment tools and third-party service providers, before you register.

Designing messages customers can verify

Registration controls who can send as you on compliant routes. Message design determines whether customers can tell your texts from imitations arriving on other routes.

• Identify the sender in the first message: CTIA guidance says the call to action should identify the organisation and the number or short code messages will come from, and that number spoofing should be avoided.
• Own the link domain: CTIA says links must not hide or obscure the sender's identity, and that a URL shortener should use a web address and IP addresses dedicated to that sender. Use one short, owned domain for all SMS links. See the Domain Portfolio and Lookalike Domain Management guide.
• Never ask for secrets by text: state in every channel that you will never ask for passwords, codes or card details by SMS, and keep links out of one-time code messages.
• Honour opt-out reliably: CTIA treats STOP as the standard opt-out keyword and expects plain-language requests such as end, unsubscribe, cancel and quit to be honoured too. Reliable opt-out lowers complaint rates that otherwise get genuine traffic filtered.
• Publish your sending identities: list your short codes, sender IDs and link domain on a help page so customers and fraud teams can check a message.

Where identity fits: the messaging platform account

A registered brand is only as safe as the accounts that can send under it. Messaging platform API keys sit in application code, CI pipelines and marketing tools, and anyone holding one can send texts that pass every registry check because they really are from you. They are also a target for traffic pumping; see the Phone Number Fraud guide.

If a key leaks, follow the API Key Leak Response Playbook and check the provider's message log for sends you did not make.

Choosing controls by organisation size

• Small organisations texting a local customer base: one messaging provider, one registered 10DLC or toll-free campaign or one registered sender ID per country, an owned link domain, and MFA on the provider account. Most of the protection comes from not being inconsistent.
• Large consumer brands: a central register of every sending system and agency, protection registrations in every market, short codes for high volume, brand monitoring for look-alike texts and domains, and a formal takedown process.
• Regulated sectors such as banking, healthcare and government services: the brands most impersonated. Add customer-facing verification pages, an SMS policy that rules out links in high-risk messages, and fraud team access to complaint and report data.
• Single provider versus several: one provider simplifies registration and key control; several give resilience but multiply authorisations, so each must appear in your registry authorisations and key inventory.

How to implement

1. Inventory senders (weeks 1 to 2): list every system, vendor and agency that sends SMS, with number types, sender IDs, countries, link domains and the API keys involved.
2. Consolidate (weeks 2 to 4): retire unused numbers, move links to one owned domain, and define the approved message formats per use case.
3. Register (weeks 3 to 8): complete 10DLC brand and campaign registration, Authentication+ for public companies, toll-free verification, and sender ID registration in each market. Allow for the one to four week campaign review TCR describes.
4. Pilot: send through each registered route to test handsets on major networks in each country and confirm the sender displays correctly and links resolve. Keep the previous route live until delivery is confirmed so you can roll back.
5. Lock down the platform: SSO and MFA on consoles, scoped keys per application in a vault, webhook signature checks and alerting on volume or destination anomalies.
6. Protect unused numbers: ask your carrier to add inbound-only and voice-only numbers to a do-not-originate list. Under 47 CFR 64.1200(p), in force with compliance required since 3 September 2024, US mobile providers must block texts purporting to come from numbers on a reasonable DNO list, including numbers whose subscriber has asked for texts from them to be blocked.
7. Prepare response: agree who handles reports of spoofed texts, how customers are warned, and how look-alike domains are taken down, using the Brand Impersonation and Lookalike Domain Takedown Playbook.

Detection and measurement

Most spoofed texts never touch your systems, so detection depends on external signals as well as your own logs.

• Customer and staff reports: a reporting address and help page form, and encouragement to forward scam texts to 7726 (SPAM), which CTIA cites as an example consumer reporting channel.
• Brand monitoring: new domains resembling your SMS link domain, and scam text samples shared by industry groups and fraud teams.
• Platform logs: send volume by key and campaign, sends to unexpected countries, template changes and new API keys.
• Delivery signals: rising filtering or blocking of genuine traffic. The FCC requires providers to keep a point of contact for senders to report erroneous blocking (47 CFR 64.1200(r)).

Framework and regulatory mapping

Common failure patterns

• Forgotten senders: an appointment tool or agency still texting from an unregistered route, so genuine messages arrive labelled as suspicious or blocked once a sender ID is protected.
• Public link shorteners: genuine texts with opaque short links train customers to tap links they cannot read, which is the habit smishers rely on.
• Personal brand contact: verification and provider notices going to an employee who has left, delaying campaign registration or incident contact.
• One API key everywhere: a single unscoped messaging key embedded in several applications, so one leak allows sending under the brand and nobody can tell which system leaked it.
• Inconsistent formats: different numbers, names and styles per department, leaving customers no pattern against which a fake looks wrong.
• No customer notice plan: waiting for a campaign of spoofed texts to hit social media before warning customers.

Practitioner checklist

• Maintain an inventory of every system, vendor and agency that sends SMS under your brand.
• Register every US campaign with The Campaign Registry through your provider, and complete Authentication+ if you are a public company.
• Register alphanumeric sender IDs in every market with a register, including Australia before 1 July 2026, and authorise each provider.
• Use one owned, dedicated link domain for SMS and publish it with your sending numbers and IDs.
• Keep links out of one-time code messages and never request credentials by text.
• Put messaging API keys in a vault, scoped per application, rotated and covered by secret scanning.
• Enforce SSO and phishing-resistant MFA on messaging provider consoles.
• Add voice-only and inbound-only numbers to a do-not-originate list.
• Run a spoofed-text response playbook with customer notice templates and domain takedown steps.

Standards and references

• The Campaign Registry: Authentication+ enhances A2P 10DLC security
• The Campaign Registry: Introduction to The Campaign Registry
• CTIA: Messaging Principles and Best Practices (May 2023)
• FCC: Targeting and Eliminating Unlawful Text Messages, compliance date notice
• FCC: Text Blocking Report and Order (FCC 23-21)
• FTC: Trade Regulation Rule on Impersonation of Government and Businesses
• ACMA: Call to action for all organisations using branded SMS
• SGNIC: Singapore SMS Sender ID Registry

Related NHI Mgmt Group resources: Vishing and Smishing Guide · Phone Number Fraud · Bulk Sender Requirements Guide · Scam Prevention in Telecoms Guide · API Key Management Guide