By Alan Murphy, VP of Engineering

For a long time, SMS worked on a simple assumption: the network could be trusted. The systems behind it were built in a different era, when the telecom ecosystem was smaller, more controlled, and the number of actors interacting with mobile networks was limited. Security wasn’t ignored, but it wasn’t designed for the scale and complexity we see today.

That environment has changed dramatically. Messaging is now a critical infrastructure for digital services. Banks use it for authentication. Governments use it for notifications. Enterprises use it to communicate with billions of customers every day. And wherever that level of reach exists, attackers will inevitably follow. The reality is that protecting the A2P messaging channel today requires a very different approach than it did even a few years ago.

Attackers evolve faster than static defences

One of the things we see consistently across mobile networks is how quickly attackers adapt. They don’t rely on a single technique. They test different methods, measure the success rate, and modify the attack almost immediately. If a filtering rule blocks one message format, they simply change the structure and try again. If a route is blocked, they look for another path.

From the attacker’s perspective, the objective is straightforward: get the message through. That message might be part of a smishing campaign, a SIM farm operation, an Artificial Inflation of Traffic (AIT) scheme, or a bypass attempt designed to avoid legitimate A2P routes. But the principle is always the same. They probe the network until they find the weakness. And if operators rely on basic filtering or manual investigation to deal with this, they’re not really in the race.

Fraud is no longer just a revenue issue

Historically, messaging fraud was often viewed mainly as a revenue problem. Grey routes or bypass traffic meant lost termination fees, and operators responded by tightening routing controls. But today the consequences are broader. Every fraudulent message that reaches a subscriber erodes trust in the channel. If customers start to associate SMS with scams or impersonation attempts, the credibility of the entire messaging ecosystem is affected.

At the same time, enterprises rely heavily on SMS for critical services such as authentication and customer engagement. If they lose confidence in the channel’s reliability or security, they will look for alternatives. So the challenge is no longer just about stopping revenue leakage. It’s about maintaining the integrity of the messaging channel itself.

Visibility is the most important capability

When we look at security in mobile networks, the most important principle is visibility. You need to understand what is actually happening across the network. Which messages are being sent, how they are routed, what patterns appear across traffic flows, and where anomalies emerge.

Attackers are constantly experimenting. They modify message content, rotate source numbers, and distribute attacks across different routes. Without visibility across the entire ecosystem, these patterns are very difficult to detect. This is where modern analytics and AI systems begin to play an important role.

Moving from filtering to understanding

Traditional systems were designed to detect known threats. They relied on predefined rules or keyword filtering. That worked when attacks were relatively predictable. Today’s attacks are far more adaptive. Modern systems need to understand not just individual messages, but the intent behind them. They must analyse semantics, traffic behaviour, routing patterns and message purpose in real time.

At VOX Solutions, we developed CLARA, our Classification and Recognition AI Agent, precisely for this reason. Rather than relying on static rules, CLARA performs the type of analytical reasoning that human analysts would normally carry out, but continuously and at network scale. Instead of simply seeing text strings, it evaluates the narrative and behaviour behind each message. This allows operators to detect fraud patterns much earlier and reduce the window in which attackers can operate.

Security and monetisation are now linked

There is another important shift happening in messaging. Security and monetisation are no longer separate discussions. If operators cannot reliably identify the intent of traffic on their network, they cannot enforce fair pricing or prevent arbitrage. Marketing traffic may be disguised as lower-cost utility messages, and grey routes may bypass legitimate termination channels.

This is why traffic classification is becoming essential for the commercial model of messaging. Through the VOX360 platform, operators can apply value-based pricing based on the purpose of each message, whether it is authentication, notification or marketing. CLARA performs the classification, and the network can enforce the correct pricing model at scale. The important point here is that classification is not just an analytical exercise. It directly affects how the messaging ecosystem functions economically.

The next phase of messaging security

If there is one lesson we have learned repeatedly in telecom security, it is that attackers will always adapt. The goal is not to create a static defence and assume the problem is solved. The goal is to build systems that can observe, analyse and respond faster than attackers can evolve.

That requires a combination of capabilities:

• visibility across the entire messaging environment
• intelligence that understands traffic behaviour
• automated analysis that operates at network scale
• enforcement mechanisms that protect both security and revenue integrity

In other words, security has to become an active, intelligent part of the messaging infrastructure.

Preserving trust in the messaging channel

SMS remains a trusted channel which continues to be relevant and valuable. It reaches every mobile device, works without internet connectivity, and continues to play a central role in digital services. But its long-term success depends on trust.

Operators that invest in intelligent security and traffic visibility will be able to protect that trust and maintain the competitiveness of the channel. Those that rely on legacy approaches will find it increasingly difficult to keep pace with the threat landscape.

The technology exists to address these challenges. The important thing is recognising that messaging security is no longer optional. It is fundamental to the future of the ecosystem.

---

Read the full analysis in the GSMA Intelligence report: Preserving the A2P SMS business in an evolving A2P messaging landscape.