TRAI extends deadline for new anti-spam rule for sending OTP messages

New deadline from TRAI: The Telecom Regulatory Authority of India has announced an extension to the deadline for the new rule that mandated scanning of SMSs containing one-time passwords (OTPs) and web links. The deadline has been extended by a month to October 1, a government official said, citing multiple requests by the telecom operators for additional time for compliance.

Initially set to come into effect on September 1, TRAI’s new rule necessitated scanning of every message containing OTPs or web and app download links for any suspicious elements. The rule will be applicable to SMSes with links that have not been whitelisted by the regulatory body. It required telecom operators to introduce a stricter policy and system for running checks on each message sent by banks and other institutions for authentication purposes.

“TRAI has granted a one-month extension to Access Providers to comply with its Direction issued on August 20, 2024, regarding the whitelisting of URLs/ APKs/ OTT links,” the statement said. “The revised Direction mandates that all Access Providers ensure that traffic containing URLs/ APKs/ OTT links, which are not whitelisted, is not permitted with effect from October 1, 2024.”

Currently, the telecom operators scan messages to check if they match the template provided by the company. Companies have so far been required to register the header and template of the message with telecom companies, so as long as these two things in a message are in place, telecom companies send the SMSes to customers. However, the content of these messages became a problem for customers with an increase in spam and dubious links. TRAI says the new rules will ensure that all SMSes from sender to receiver are thoroughly checked, revealing contents to telecom operators, who will have the authority to block messages that do not follow the guidelines.

The telecom regulator has also mandated telecom companies to ensure that all messages from sender to receiver are traceable from November 1.