TRAI announces new rule that may delay OTPs from banks, other services

Telecom Regulatory Authority of India (TRAI) has come up with a new set of rules aimed at curbing the spread of spam and phishing attacks through SMS. Set to come into effect from September 1, the new rules mandate institutions such as banks and app-based services to register themselves and whitelist their numbers latest by August 31 to send one-time passwords (OTPs). The new system in place would also scan messages for any suspicious links, eventually delaying the delivery of OTPs to users.

The existing system requires a company or institution to register the header and template of the message with telecom companies before they can start sending OTPs and other messages that facilitate authentication. The content of their messages, however, are not registered or scanned, making it easier for companies to quickly deliver OTPs. The new system will require telecom companies to run each message through a scanner, giving them access to the contents of the messages. They can also block messages that do not follow the new template, meaning if a benign SMS from a bank containing OTP does not follow the template, it will be blocked.

TRAI’s new rule will also impact the delivery of transactional alerts, making it difficult for users to obtain the latest update from their banks if the latter does not follow the template. According to the telecom regulatory body, the new rules will help reduce fraudulent activities, but telecom companies are pushing for an extension to the September 1 deadline. A report, however, suggested that TRAI is stringent about the deadline and may not extend it.

Meanwhile, the telecom regulatory body is also working with telecom companies to prompt mobile subscribers with the name of the caller according to their KYC (Know Your Customer) documents. Reports have suggested that this move will reveal the true identity of a caller, eliminating the need for caller identification apps such as Truecaller that rely on user data to identify a phone number. TRAI’s system will associate a number to the owner’s government-issued documents, leaving no scope for fraud.