Blog

Account Takeover: What You Need to Know

2013-05-06T17:38:41+00:00

A few weeks ago, I spoke at the Merchant Risk Council in London with Sudhir Jha from Google about Account Takeover (ATO). For several years ATO has been a hot topic for email platforms and social networks, and is now gaining mindshare fast from leading merchants. Ironically, in many ways, merchants are somewhat responsible for the rise in ATO. Merchants became so good at identifying and blocking fraud at the transaction level that fraudsters were forced to identify new methods.

To detect account takeovers, you must build models that look for anomalous behavior on a user-by-user basis. This can include using a new device or IP, or a change in the session behavior. For example, Customer A typically is a deliberate purchaser and will sort through multiple products pages and read several reviews before making a purchase. If Customer A’s account makes an immediate purchase without the normal deliberate behavior, it could be a sign of ATO. The biggest difference in detecting ATO compared to standard CNP fraud is the need to build these models on a user-by-user basis. Across users, machine learning and rules should not be minimized and are still crucial for detecting CNP fraud, but ultimately anomalies on a user-by-user basis are the most effective ways to identify a pattern that could be representative of a fraudster taking over an account.

Another challenge merchants face is what action to take when a potential ATO is detected other than outright rejecting the transaction. Detection systems can be vulnerable to false positives, which can have a big impact on the user experience. For example, let’s say that my purchasing behavior is normally deliberate, there may be occasions where I make an immediate purchase. Perhaps I have already done enough research on other sites or maybe I do not have the requisite time to be as deliberate as normal, or perhaps a friend sent me a link to a product they recommended. In cases like this, it is better to have a challenge framework in place rather than outright reject the transaction. Some of these challenges can be:

Two-Factor Authentication- send a one-time passcode to the user’s phone and require re-entry back into the merchant site
Require re-entry of a credit card number
Require the user to answer a knowledge-based challenge (although the answer to these can be easily guessed or socially engineered.)

Building a model to detect anomalies on a user-by-user basis and having a comprehensive challenge framework to use when an anomaly is detected is an effective strategy to combatting ATO, while minimizing the impact on user experience.

Learning from LivingSocial

2013-04-30T16:21:44+00:00

With the huge LivingSocial hack that we read about the other day it’s clear that there are common themes that we’ve seen many times lately. In this case the news is a little better than previous but let’s review what we know:

50 million accounts have been compromised with email address and salted passwords
Living Social as a precautionary measure is asking all users to reset their passwords
No news on how the hack was perpetrated

So there is a little bit of good news here. "What might that be?" you’re probably asking. Well the security folks at LivingSocial did salt their passwords which makes any attack against the hashed passwords much harder. When you salt a hashed password, that means when you try and log in to the site, what’s happening on the back end is the salt, a few bytes of random data, is combined with your password. Then it is hashed and stored in the database, “HASHING ALGORITHM” is run on (SALT + Password) which creates a “HASH."

Why is this good? Well let’s say the passwords were hashed and then not salted. When this happens someone can get a dictionary or a list of commonly used passwords then you figure out what hashing algorithm that the site was using (typically SHA2 or if the site is very old MD5) and then you just calculate hashes against the big hash list and compare your hashed dictionary to the stolen accounts. If the site has hashed passwords however you need to create this big dictionary hash list separately for every single user. That takes a really long time! Hashing protects all 50 million passwords from getting cracked. What is does not protect against is a single account being cracked.

Ok so now should you change your password? Yeah probably. So what can websites do?

Use two-factor authentication (2FA)
If LivingSocial has used 2FA then it wouldn’t matter if user passwords were stolen, the accounts wouldn’t have been able to be compromised unless the attacker had the password (something the user knows) and had the 2FA device (a mobile phone in the case of TeleSign, which is something the user has). To get into an account you want there to be two components, one you know and one you have.
Salting is good, double salting is better. If they had double salted their passwords and stored the second salt somewhere other than the database it would be impossible to crack them.
Don’t use MD5 or SHA2 as a hashing algorithm use bcrypt. Basically SHA2 is super-fast, relatively speaking bcrypt is slow and makes hash breaking impossible on a large scale.

Read about it here: https://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/

I hope LivingSocial follows up their announcement with a detailed post mortem. The way the community gets better about security is by understanding what mistakes were made, embarrassing as they may be. There are some things they could do better to protect their users, but they’ve taken the first important step in telling people something happened, let’s hope they follow up with changes so that this can’t happen again.

AP Hack Begs for Stronger Security

2013-04-25T23:24:56+00:00

The other day the Associated Press (AP) twitter feed was hacked through a spear-phishing attack against AP employees. It was apparently instigated by the Syrian Electronic Army (SEA) — a Syrian government aligned hacking group. The SEA has either taken credit for or has been blamed for attacks recently against news organizations like CBS, NPR, and the BBC, as well as international organizations like FIFA.

Clearly, We’re now in an era where cyber terrorism or cyber warfare is becoming more common. In some cases these acts may be perpetrated by sovereign states, as was the case with Stuxnet and its attack on Iran’s nuclear program and very specifically targeting the centrifuges that they were using to enrich uranium to weapons-grade level. In other cases there may be pseudo government aligned entities like the SEA lashing out against organizations that aren’t aligning with their political agenda. Two other common perpetrators in these attacks can be groups like Anonymous who push a variety of political, legal, and anarchical agendas or the unknown black hat agent who may be just doing something because they can.

During the news frenzy of the Boston attacks last week the news, link aggregation, social media, and internet naval gazing site reddit was attacked. As part of their post mortem they stated, regarding who perpetrated the attack, under the call out of “conjecture:”

"I'd say the most likely explanation is that someone decided to take us down for shits and giggles. There was a lot of focus on reddit at the time, so we were an especially juicy target for anyone looking to show off. DDoS attacks we've received in the past have proven to be motivated as such, although those attacks were of a much smaller scale. Of course, without any clear evidence from the attack itself we can't say anything for certain."

Regardless companies must take a more aggressive stance on security.

One of the key areas of focus in making security better is by helping to better secure accounts. Federation technologies like SAML have been around for a while but have only become common in enterprise scenarios as they require tight integration between two entities and are complex to implement and manage. Other technologies like OpenID have shown promise, but flaws in the protocol and wavering interest in key organizations and with individuals that were pushing this initiative have made it so that the technology isn’t widely enough adopted to be useful.

The latest approach seems to be around the FIDO alliance. FIDO is an alliance of several organizations and companies that are trying to align to “support the international standardization of OSTP by a recognized standards body.” Although this seems like a great goal, I guess, OSTP isn’t a published standard today and the only implementation of this “standard” is by a private company. The goals of the FDIO alliance are lofty but they are at a nascent stage, and given that they are currently bypassing standards bodies, it’s difficult to understand how much of FIDO is marketing vs reality.

I’m a big believer in using what we have today, in our hands right now, and using that to make the world a better place. Mobile based (either voice, SMS or app based) two factor authentication (2F) is here today and organizations such as Google, Apple, and Microsoft have all implemented this in some way, shape or form in their products. Google and Microsoft have made broad statements about rolling this technology across their platforms to their users. Although 2FA isn’t going to stop Anonymous, it will make the gigantic releases of username and passwords to sites like Pastebin.com irrelevant since a password won’t be sufficient to log into a site.

I like the approach that Gabe Newell the founder of Valve Software, publisher of the Half-Life series of games among other hugely popular games, took. Gable when he implemented 2FA in their Steam online store published his username and password in public saying that with 2FA it didn’t matter if it was stolen his account would still be secure.

Here it is:

Username: gaben@valvesoftware.com
password: moolyftw

Good luck in cracking into there.

Justin Bieber’s Twitter Followers are Fake!

2013-04-12T17:08:57+00:00

On my way to work this morning I was listening to popular morning show Kevin and Bean. They were discussing Socialbakers’ recent report that more than half of Justin Bieber’s followers are fake. Shocking! Bean went on to say that, “I guess Twitter is free and you only need an email to sign up and since that is free too, you can sign up for as many twitter handles as you want.”

Exactly, fraudsters, spammers, and entrepreneurs looking to make a buck selling followers, can sign up for as many accounts as they want. These accounts can be used in all types of ways, nefarious and benign, including:

Falsely inflating the number of celebrity or company followers to create the appearance of popularity, influence, and a larger share of voice
Propagate spammy tweets for “recreational” medicines or other annoying offers
Bolster SEO efforts by creating 100s of tweets with links to a website or eCommerce page
Hijacking Twitter's trending topics to get people to click links
Embedding malicious Bit.ly links to install malware

Should you care that Justin Bieber has fake followers?

Maybe. If you are an advertiser, the answer is an aggressive yes! Kim Kardashian is known to have commanded $10,000 per tweet back in 2010 at the height of her celebrity. That 10K is based not only on her presumed influence, but also on the number of potential customers who will see that tweet. Additionally, if you advertise through twitter instead of asking a celebrity to tweet that they love your FroYo, your demographic and reach are not accurate if twitter isn’t doing anything to regulate their account sign-ups.

If you’re just an average user, you’re affected too.
I’m sure Viagra is great, Cialis is probably dandy too, but I'm never going to buy it so please stop serving up the offer.

Since Twitter’s main source of revenue is from advertising, I’m going to assume that they were not too pleased to hear about Justin Bieber’s followers. But, they have larger problems to solve. I’m a marketer, I should love twitter and I used to. I managed a personal account, a business account, I helped sign-up the exec team and encouraged them to tweet. I stopped all that a few months ago when my account was hacked multiple times. I just got sick of friends and colleagues forwarding me my tweets about having their “pictures from last night.”

There is a really simple and elegant solution for all of this. Your phone number. A phone number is the only unique identifier that we have as humans. You can figure out my user name and password, you can steal my SSN, you could even open email accounts in my name and pretend to be me, but you’ll be challenged to steal my phone and my phone number.

Twitter – ask me for my phone number! I’d happy give it to you to protect my account and to show you that I am a legitimate person. Ask for my phone number during the registration process to ensure I am who I say I am. And then have me re-verify with that phone number if I’m posting something suspicious.

While you’re collecting my number take a look at the type of phone and the subscriber status. If it is a VoIP number or a disconnect phone number, chances are that it is a fake account. Do what many companies are already doing. Protect your users' accounts and improve their experience by associating their phone number with their account.

7 Things You Need to Know about International SMS

2013-03-29T20:01:32+00:00

In the beginning there was only ASCII. ASCII is the basic language that all other character sets are based on. ASCII characters are the uppercase and lower case letters A to Z, plus some basic punctuation. ASCII is a universal set of characters, every device everywhere understands what ASCII is. At the dawn of SMS 20 years ago, ASCII characters were the only ones you could reliably send in an SMS message.
Not everyone speaks English. As much as we might wish everyone spoke one language and we didn't need any other characters to express their language, it just isn't so. The world is a very interesting place, with an incredible variety of characters, accents, symbols, and punctuation. We can't expect the world to only accept SMS messages in plain ASCII.
In the old days, different language meant different encoding. In the past, if you wanted to send a message to a user in Greece, you had to use a Greek character set. If you wanted to send a message to a customer in Russia, you had to use an entirely different character set with Cyrillic characters. And the user had to have the same character set installed. If this sounds complicated, rest assured, it was much worse than it sounds!
The GSM encoding was created to solve this problem. For Western Europe, at least. The GSM encoding allowed for the entire ASCII character set, plus a lot of common accented characters to be sent in an SMS. This encoding standard also allowed using fewer bits per character, which means you can send 160 characters in an SMS instead of only 140.
Enter Unicode. Unicode was intended to be the one code to rule them all. It is a new system of representing every character in use today. It also includes characters from many ancient languages, and it still has plenty of room for other stuff (Emoji, anyone?). Unicode has room for 1.1 million characters, and currently has about 110,000 that have been assigned.
There are different Unicode encodings. Unicode is a great improvement, but we still need to turn those Unicode characters into something that computers can understand. There are several different Unicode encodings. Each of them has strengths and weaknesses. UTF-8 is universal and has many strengths, but is not always well supported in the mobile world. UTF-16 is another modern encoding and is a good choice for Asian languages in particular, but reduces your SMS message length to 70 characters. UCS-2 is an older version of UTF-16, but a lot of devices still require it.
Every Provider is different. It would be great if all of the SMS carriers and aggregators out there supported the same encodings in the same way, uniformly around the world. They don't. (But you already knew that, didn't you?) Most carriers in Europe support the GSM character set, while those in the US generally do not. Japanese carriers sometimes support the Shift-JIS encoding. Some carriers can handle UTF-8, some insist on UCS-2.

Ok, I get it, international SMS is complicated, now what?

If your business needs international reach with SMS, make sure to ask these questions of any potential vendor:

What countries do you support sending SMS messages to? If you need global reach, make sure your provider supports the countries you're interested in. A lot of aggregators specialize in specific countries or regions. Only a few have worldwide reach.
What languages and encodings does your provider support? US based providers might only support sending messages in plain ASCII. European providers probably support GSM. Better providers will let you send your message to them in UTF-8 and do any necessary conversions for you.
Does your provider automatically normalize messages when it is necessary? If you're trying to send a message and the recipient can't receive it in the language you sent it in, does your provider try to send it as plain ASCII for you automatically?

Understanding all the intricacies of International SMS messaging can be daunting, especially if your provider doesn't give you much help. However, if global reach is a necessity for your business, taking the time to find a provider that understands these details can take much of the sting out of it.

Top 6 Reasons You Should Consider Voice Authentication

2013-03-06T02:39:11+00:00

Offering voice-based authentication as a complement to SMS-based authentication isn’t just about offering your users a choice, it’s fast becoming a business requirement for larger corporations and best practice for any web property looking to serve the diverse needs of their global users.

Here are six real-world benefits of voice-based authentication. Some are financial, some karmic, but collectively they make a compelling argument for adding voice authentication to complement your SMS-based authentication model.

Give your users choice. As a best practice, the leading global web properties give their users the choice of receiving an authentication code via SMS or voice call. While SMS-based authentication is much more prevalent, we should not forget that some people may actually prefer voice-based authentication. In fact, 53% of adult cell phone owners questioned in a survey conducted by the Pew Internet and American Life Project on Americans and Text Messaging said they preferred receiving a voice call to a text message.a Plus, the voice option equips your end users with an easy alternative if they experience any SMS delivery issues.
Reach more users. While landline usage is declining, 48% of US homes still have and use a landline (according to a study by the Centers of Disease Control who looked at phone usage in H1 2012). Moreover, some users do not have SMS plans and are charged per message and many older users are simply not comfortable using text messaging.
Reach more markets. In certain countries, even in large markets like Japan, SMS is inherently challenging. Therefore, offering a voice option is sometimes the only way to reach these markets. For companies looking to reach a truly global user base, voice messaging is a practical alternative and complement to SMS-based authentication.
Meet ADA Mandates. Consider the Americans with Disabilities Act (ADA) whose charter is to ensure that everyone regardless of disability has an equal opportunity to enjoy consumer and business services. So, if your organization is ONLY offering SMS-based authentication, how are you helping serve the needs of the blind. Approximately 2.5 million people in the United States are “legally blind” and, many of them have some residual vision. Only about 5% of blind people use Braille for reading; many people who are legally blind are able to read large print. Plus, there are millions more who have “low vision” with some significant impairment that substantially limits their ability to see well under different circumstances. Given the increasing popularity of two-factor authentication, SMS-based authentication is a genuine challenge for the blind who cannot easily read the one-time passcodes delivered to their mobile phones.
Lower your helpdesk costs. If your business relies exclusively on SMS, some end users will end up requesting SMS messages to their non-SMS-enabled phones or they will call a help desk to request an authentication code. Based on our experience with the world’s largest web properties, this translates into more calls to your call/support center and negatively impact customer satisfaction. As a result, companies pay extra costs on two fronts: they pay for the extra SMS messages and for the support costs associated when customers call a help desk to request their one-time passcodes.
Add some personalization. Customers can customize the voice message by using their own voice talent or the voice of a familiar character (e.g., an online gaming company using the voice of a popular character to deliver the one-time passcode). As more companies explore creative ways to add stickiness to their online service, personalized messaging is a novel and cost-effective approach.

OK, I’m sold on voice-based authentication, now what?

Once you decide that you want to complement SMS-based authentication with a voice option, make sure to ask these questions of any potential vendor:

Do you offer voice-based authentication? This may be a little obvious, but many authentication providers and SMS aggregators only offer SMS. Offering the voice option means that the vendor should have invested in the infrastructure, the network and carrier relationships to delivery a quality service.
Can you deliver the voice messages to the countries where your users are located? Ideally, the solution provider has a global footprint, but it also means localizing the voice messages into the languages and dialects of your users.
Can you detect the phone types of your users? With PhoneID, TeleSign can detect the phone type so companies can send SMS messages to SMS-enabled phones and voice calls to landline phones.
Does the provider have connections to Tier 1 global providers? How do you know if you’re dealing with Tier 1 global providers? You can often hear in the quality of the voice call. With Tier 2 providers, you will often experience latency (i.e., delays on the call), jitter (refers to the variability of the latency), and packet loss. Just as it's important to hear what someone says in the order they say it, it's also important to hear all of what they're saying. If you miss one out of every 5words or 5 words all at once, chances are you're not going to understand much of the conversation. This is packet loss. This happens when voice packets are dropped by network routers, switches become congested (lost packets), or packets are discarded by the jitter buffer.

Does your provider offer failover routes for voice? Like SMS, you want to use a provider who employs failovers at an operator and country level so if one carrier/operator is experiencing difficulties, you can immediately failover to another operator to ensures optimal delivery rates.
Does your provider auto-correct phone numbers? Often when users are prompted to enter their phone number for authentication they forget to account for regional peculiarities. For example, you need to drop the leading zero in the UK, but you need to add a “9” to the area code when placing a voice call to Argentina. Believe it or not, this auto-correcting can improve deliverability by as much as 20% in some markets.

Adding voice-based authentication as an option to SMS delivery just makes plain business, practical and ethical sense. After all, it's a matter of winning over your customers by equipping them with rock-solid security and excellent user experience. The good news is that you no longer have to sacrifice one for the other.

Source: pewinternet.org/Reports/2011/Cell-Phone-Texting-2011.aspx

Mobile World Congress 2013

2013-02-21T20:29:57+00:00

The upcoming Mobile World Congress in Barcelona, Spain, is the mobile industry's biggest showcase of new devices.

A lot of the focus will likely surround the development of new quad-core smartphones with 1080p HD screens. There will also be plenty of buzz around the Windows Phone 8 (phones & tablets) as well as new Android phones from Nokia, HTC, and Samsung (even if they’re not debuting the Galaxy S4). We can expect the swirling debates to continue as to whether BlackBerry and Microsoft can still compete as underdogs in a world now dominated by Android and iOS.

Blah, blah, blah…

I’m way more intrigued by the ecosystem behind the handsets and how it will change the every day lives of today’s businesses and their customers. Things like how global messaging is evolving, the rise of B2C and application-to-person (A2P) text messaging, online security/privacy, and information protection in the cloud are just more interesting.

There is so much going on just in the world of A2P SMS. The A2P market is expected to be worth $70.1 billion and overtake person-to-person (P2P) SMS by 2016 (Juniper Research, 2011). This is not surprising given the rise of mission-critical, service-enabling messages used to cement customer relationships. Example include:

Confirm deliveries: With SMS, companies can track packages and maintain inventory levels every time as stock arrives. Transactional-based triggers allow alerts to be set up based on when inventory levels get too low, when assets are disposed, and the like. Plus, messages can give exact delivery times and dates, so your customers know you when their package is going to be delivered.
Send product alerts: Text messages enable businesses to provide excellent customer service and deliver new product notifications cheaply and easily.
Appointment Reminders: Doctors, dentists, financial planners and a wide range of business professionals can leverage SMS for automating appointment reminders.
Status Alerts: Many cloud-based technology firms are looking to use text messaging for system alerts (e.g., when an individual or server are reaching capacity thresholds). This also includes airlines notifying customers when there are flight changes or delays so they can make alternative arrangements if need be.

With the acquisition of Routo Telecommunications (rebranded as TeleSign Mobile), we’re a mobile operator in our own right with network access and direct connections to global operators. This not only enhances TeleSign’s suite of security and authentication solutions, but enable us to provide these types of emerging mission-critical SMS services to the largest global web properties.

NOTE: If you happen to be going to MWC, I encourage you to stop by the TeleSign Mobile stand (Hall 8.1, Stand81J38) to learn more about this exciting new partnership.

So, if you get tired of the bells and whistles of the new phones, make sure to peel back the onion and explore all the new areas of growth that make up this evolving ecosystem.

TeleSign Mobile Joins TeleSign - Another Unconventional Move

2013-02-15T17:00:29+00:00

Over its 10 year history, RoutoMessaging has become known as something of an unconventional player in a crowded industry. We have stood out for two reasons, above all: our focus on superior quality while most others chase the lowest possible price, and our dedication to achieving truly global coverage by forging meaningful partnerships with operators around the world. Relentless pursuit of these aims has helped us become an indispensable partner to hundreds of customers who depend on us, around the clock, to deliver critical information to their users, no matter where in the world they happen to be. We are very proud to have become a truly integrated part of their business processes.

Today we are excited to announce another unconventional move. We have joined forces with TeleSign, the leading provider of phone-based fraud prevention and intelligent authentication, and are re-launching under a new brand name, TeleSign Mobile.

TeleSign has spent years enabling some of the world's largest online companies use innovative means to combat fraud and verify identity, and the user's mobile device has become a tremendously powerful component in delivering these services. By acquiring RoutoMessaging, TeleSign gains greater control over how messages are delivered to users, which leads to a higher quality service, as well as access to network-level data to ensure that transactions are occurring in a trusted environment.

By re-launching as TeleSign Mobile, a dedicated messaging and data services division, we can use our renowned mobile messaging network to mobilise even more services and business processes for TeleSign's customers, as well as the many enterprises we serve today.

TeleSign Mobile will continue to stand for global reach, mission-critical reliability, and trust - all values our colleagues at TeleSign share. And we will continue to do things a little differently from the rest of the industry. So watch this space, as the most exciting news is yet to be written.

Our official press release can be read here, and we have prepared answers to some of the questions we imagine you may have. We hope you are as excited as us about what the future holds for TeleSign Mobile, and as always we would love to hear from you if you'd like to get in touch.

Six Crucial Questions for Mission-Critical Messaging

2013-02-14T22:21:09+00:00

7.8 trillion text messages were sent in 2011 and that number was expected to reach about 9.6 trillion in 2012 (Source: Portio Research).

However, for the most part, texting has been a person-to-person (P2P) phenomenon with a smaller portion of the traffic attributed to business-to-consumer (B2C) SMS, which has grown over 50% in the last two years.

The business-to-consumer SMS (sometimes referred to application-to-person or A2P) has been taking off significantly and is now growing faster than P2P. This growth is being fueled by businesses, which are leveraging SMS to automate business processes for communicating and engaging with their customers, suppliers, and employees.

B2C Messaging Types
There is significant demand for taking business-to-consumer SMS messaging to the next level by simplifying ecosystem pricing as well as making access to the SMS infrastructure more user-friendly. B2C messages take a variety of forms including:

SPAM: Illegal spam text messages in the U.S. increased 45% in 2011 to an incredible 4.5 billion messages. This type of traffic can cause huge spikes for mobile operators and aggregators, and often impacts the delivery of truly mission-critical messages that end up getting queued behind these messages, causing significant message delays and consumer inconvenience.
Mass Marketing: Mass marketing messages differ from SPAM in that they are opt-in, but they are generally not considered mission-critical from a delivery perspective (though they may be for the legitimate marketers behind them).
Business Process Automation: This includes a broad spectrum of mission-critical messaging for enhancing business communications like shipment notifications, calendar invitations, appointment reminders, and status alerts such as flight confirmations and delays.
Security Messaging: Authentication and verification messaging used to verify and protect online identities and mitigate fraud. Security messaging requires the highest level of deliverability because of what’s at stake – things such as transaction verifications, registrations and password resets are increasingly relying on an SMS delivered to the consumer’s phone. So, when it absolutely, positively has to get there... use a provider that has the network connections, relationships, and processes to optimize delivery rates.

Mission-Critical Messaging Requires a Unique Skillset
As the demand for B2C SMS has exploded, so too has the vendor landscape. There are a variety of operators, aggregators, mobile communication, and phone-based authentication solution providers that have emerged to fill this gap.

If your business depends on sending truly mission-critical, security-related messages to verify online identities, transactions, or shipment delivery, you need to ask these questions of any prospective vendor:

Do you “cleanse” the phone numbers?
When users enter phone numbers into online forms, they are not always properly formatted for delivery. Phone number cleansing automatically corrects improperly formatted phone numbers to adhere to complicated and dynamic international dialing rules that can vary by carrier and geography. Cleansing can improve SMS deliverability by as much as 20% in some geographies.
Can the provider “localize” the SMS message?
As more and more companies become global, they need to reach an international user base. This means you may need to localize the text of the SMS into languages and dialects that your users will understand. If you don’t have this expertise in-house, make sure to ask your provider if they can customize the SMS into the languages and dialects of your user/customer base with custom SMS templates.
Do you want to manage the complexity of short and long codes?
There’s a fair amount of complexity when sending an SMS across borders and across mobile operators. In order to span the globe, businesses need to use a combination of SMS long codes, shared short codes, or dedicated short codes for their mission-critical messaging. The right solution will depend on the use case, the geography, the mobile operator, the volume of messages, and a variety of other variables. Some SMS providers require you to manage this complexity in-house or you can rely on a service provider that manages this as part of a quality practice.
How many failover options does the provider offer?
With most mobile operators and SMS aggregators,, every message gets essentially one shot at delivery to the destination operator. This does not ensure the highest delivery percentage. Instead, look for a provider message that employs a “waterfall” where individual SMS messages are re-tried through one or more providers in response to failures, delays, or other network conditions.
Does the provider have direct network connections?
A Mbile Network Operator can provide the ability to connect directly to the more than 800 operators around the world. This special status offers the potential of higher deliverability, increased transparency/visibility, and better stability in cost and service availability.
What kind of support is offered out of the box?
Customer support in the Telco industry is infamously poor. And this poor support often trickles down to the mobile operators and aggregators who operate on razor-thin margins. Consequently, many SMS aggregators and simple API providers operate on a low-cost, self-service model. This may be fine when dealing with mass marketing communications, but is seldom sufficient for mission-critical messaging. Make sure to ask these questions:

Is the cost of support included in the service? If not, what is the cost of support?
Do they offer phone and email based support?
Do they offer emergency (24x7) phone support?
Do they offer integration support andor offer best practices guidance?
Can they provide guidance on the optimal user experience or user interface?
Do they offer proactive alerting?
Do they offer access to a client portal and provide troubleshooting tools?
Do they offer canned and ad hoc (i.e. customized) reporting?
Do they offer SLAs and Service Level Objectives (uptime, technical support response times)?
Can the provider provide best practices on fraud prevention and risk mitigation?

These six questions will quickly separate the mission-critical contenders from the pretenders, and will help ensure the highest possible delivery percentages, the lowest levels of fraud, and the very best customer experience.

TeleSign Gears Up for RSA 2013

2013-02-14T22:02:51+00:00

If you’ve been to RSA before you know it can be quite the show, booth babes, giveaways and sometimes even magicians. This will be my second year going and I can’t wait to set up our newly designed booth with a fully equipped charging station. It doesn’t matter what kind of phone you have, we’ve got the charger for you!

Stop by our booth, #533 chat with the team, charge your phone and demo the TeleSign Authenticator. If you haven’t already scheduled time to chat, feel free to email me for an appointment. Looking forward to seeing you there!