The losing battle against phone spam

“You are selected for the Work from Home job offer. Get your payment 8,000-30,000 ₹ per day (Click the window below to inquire).”

I frowned. Two months ago, another poorly worded WhatsApp had crept into my inbox, promising “ ₹ 20,000/day” for “Home based JOB”. Another that was sent in August had dangled the offer of Bitcoin riches:

“Important. Bitcoin realizes your dream of wealth. Professional investment team will make you ₹100,000 to ₹500,000 easily. Click on Whatsapp to learn.”

Going by anecdotal evidence, I am not the only person being spammed thus.

Annoying SMSes, pesky robo-calls continue to flood our phones and interrupt our workdays and seek to tempt us into give away confidential information.

“I block unknown callers and messages almost every day,” said Anshul Tembhurne, a 23-year-old professional in Gurgaon, who says that he gets about 2-3 calls a day and at least 4-5 spam messages a week.

But what do the numbers say? Has spam really gone up? Chairman of Telecom Regulatory Authority of India (Trai), P.D. Vaghela, says that spam has gone down 15% versus last year but did not share any data to support this claim.

In a survey carried out this year, LocalCircles, a platform that provides social media for communities, found a continuing onslaught of spam SMS.

Of the 57,000 mobile subscribers surveyed, 100% reported receiving spam or promotional messages each day. About 68% reported receiving four or more such messages each day, regardless of their registration on the do-not-disturb, or DND, list.

The spam problem is much worse than before. In 2021, LocalCircles had found that 95% of 35,000 mobile subscribers it surveyed continued to get spam and promotional SMSes and 73% were getting four or more unwanted SMSes on a daily basis.

And, something else is different this year. Sachin Taparia, founder of LocalCircles, says the platform has received several complaints about spam WhatsApp messages in the last 12 months. The results confirmed the trend. 95% of the survey participants got one unsolicited message each day on WhatsApp. The survey showed 51% of mobile users got four or more promotional or spam messages on WhatsApp alone despite the provision to report spam or block numbers. It also found that 44% people were getting 1-3 messages daily on WhatsApp, 29% were receiving 4-7 messages on a daily basis, and 22% an average of eight or more messages.

The new spam route

By definition, spam or unsolicited commercial communication is an unwanted message you receive by either message or voice call. A message or call can also be called spam if you have not given consent to get messages related to a specific product or service.

While the definition of spam remains same, the way it reaches consumers has changed, from text messages to messaging apps. Taparia noted that since users were spending more time on WhatsApp (and SMS was mostly used for one-time passwords or OTPs), spammers are also rapidly moving to the platform.

Messenger apps are usually favoured for personal interactions and enjoy a certain level of trust. That makes them vulnerable to fraudulent activities, said Mukul Shrivastava, partner, forensic and integrity services at EY.

“It is not the lack of regulations but the mammoth task of monitoring such huge volumes of messaging traffic that makes it difficult to bring spammers to order,” he said.

Users on Telegram have also started to receive spam, albeit in a different way. They are added to groups without even been asked. For instance, I’ve been made part of three groups that provide tips for trading cryptocurrency, without my consent.

More worryingly, some types of SMS spam are a way to scam consumers. These typically warn of electricity bill connections being snapped, if payments are not made, or promise to pay them insurance bonuses.

“The messages ask the customer to click on URLs to upload either their bank information or to download an app. Once downloaded, the apps give scammers access to the device. They can then use incoming messages such as OTPs received from banks and use them to transfer money from these customers’ accounts,” explains Nitin Singal, managing director at Sinch India.

Players like Sinch, Gupshup, Twilio and others provide two-way conversational platform solutions across SMS, voice and email, which is used by brands to send marketing messages to users who opt-in via SMS, social media apps. They also enable banks, retailers, utility companies to send transactional messages.

Scam messages have the regulator and the government worried since there is no regulation in place to govern spam on over-the-top (OTT) communication apps, and more so, spam emanating from such apps. OTT in this case would mean apps such as WhatsApp, Telegram, Signal and others.

What happened to DND?

The DND app was provided by Trai for consumers in June 2016 so that they would not be swamped by promotional messages and calls. But, according to the Localcircles survey, that filter is not working.

Data, from a report on the use of distributed ledger technology to control spam on the Trai website, reveals that about 230 million subscribers have registered for the Do-Not-Disturb service that blocks unwanted telemarketing calls and messages offered by telecom service providers. Yet, the services of 1.2 million illegal telemarketers have been terminated so far, even as the total count of registered telemarketers remains at a meagre 22,000.

In April this year, the government told the Lok Sabha that complaints received by telecom companies against unregistered telemarketers have nearly tripled—from 307,043 in 2020 to 855,771 in 2021.

Industry insiders said that the old DND model was aimed at curbing the menace from text messages or SMS, which is why it is unable to deal with the barrage of such messages on social media and messaging apps.

The problem also boils down to the easy availability of mobile numbers of consumers.

Millions of telemarketers have access to millions of mobile phone numbers for as low as ₹1,000 in the grey market, said an industry insider, asking not to be named. When users give out their mobile numbers at a restaurant or supermart for billing, that counts as consent, said industry insiders, even though the user may not have given explicit consent for receiving marketing or promotional messages.

“Once you have given your mobile number, you’re bound to get WhatsApp messages from the brand. Online stores use the same method,” the person added.

During the pandemic, various attempts to hack websites and acquire user information came to light. “This information is used by scammers to call unsuspecting customers posing as their bank/ insurance company representatives and get further details,” said Singal. In the absence of a data protection law, which aims to protect user privacy and user data, telemarketers find it easy to operate in a grey area.

Stemming the tide

The government has so far taken reactive steps to stop unlawful callers and spammers. A senior official who did not want to be quoted said that the department of telecommunications recently banned an app that was having servers in Singapore and enabling spam messages through a portal.

The regulator has been fighting spam through Telecom Commercial Communications Customer Preference Regulations. These rules direct telecom companies to keep a record of commercial message senders, including banks and registered telemarketers. They also levy fines of up to ₹50 lakh per month on erring telemarketers, and cut off resources of unregistered telemarketers while blacklisting them for two years.

In March last year, it asked telcos to initiate the use of a blockchain-based system to track and verify commercial SMSs sent by telemarketers. The process was termed as scrubbing of SMSes.

Last year, the telecom department created two special wings—digital intelligence unit and telecom analytics—for fraud management and consumer protection. The government also fixed a penalty of ₹10,000 per violation for pesky callers and message senders on telecom networks. Repeat offenders will have their numbers and devices disabled.

The government claims that the draft telecom bill issued last month, which controversially brings OTT communication apps like WhatsApp under the purview of telecommunication services, will provide users protection from unsolicited messages, spam callers and fraudsters.

Tech vs spam

It’s not as if messenger apps aren’t grappling with the problem. In response to detailed queries sent by Mint, a WhatsApp spokesperson said that it has invested in artificial intelligence and other state-of-the-art technology and processes to keep users safe on the platform. According to its latest report, WhatsApp banned over 2.3 million accounts in August.

On WhatsApp, businesses need to get opt-in from customers before initiating a conversation with them, and this can be obtained in a number of ways. For example, on their website, in a store or even directly over WhatsApp. But they are allowed to send a limited number of messages per day.

It has systems which make it faster for WhatsApp to stop a business flagged by users. Industry insiders said that WhatsApp was building options for users to opt out of specific types of messages they receive from a business, such as coupons or promotions.

“This will allow people to keep hearing from the business but have more control of the type of messages they receive from them,” said a person familiar with the plan under development.

Gupshup’s Seth said that WhatsApp’s model actually gave users more control as blocking senders ensures no future pesky messages from the same person, as opposed to text message spam where the receiver has no option but to delete the message and move on. “With that feedback loop, the overall quality of business messaging will keep improving continuously and rapidly. This is a huge step up from the previous era,” he said.

Telegram spokesperson Remi Vaughn admitted that spammers’ methods were changing. “But we have robust antispam measures that are constantly evolving and adapting to outsmart them. We have also empowered our users with options to control who is able to add them to groups and channels with granular precision,” he said in response to queries from Mint. He added that the platform was blocking hundreds of thousands of would-be spammers every day, using these tools.

Operating systems such as Google’s Android, used by more than 95% of the country’s smartphone users, flags a user when he or she is getting a spam or ‘junk’ call, with the help of an in-built system.

“Google maintains a database of suspected spam callers that goes beyond what carriers maintain,” a Google spokesperson said.

Messages by Google, the text messaging app on Android phones, uses machine learning models to detect known patterns linked to spam, phishing, scams or malware on the user’s device.

The long wait

Trai secretary V Raghunandan told Mint that the regulator was exploring certain technical solutions to deal with spam, including a review of the DND app so as to improve its efficiency. “I agree with you that there are some issues that people have raised regarding DND, which we are looking into,” he said. He did not share the features or the timeline for the improved DND app.

Raghunandan added that the regulator will soon begin comprehensive consultations on the telecom bill, where it will attempt to address the issue of spam on messaging apps like WhatsApp.

The consultation will take at least two to three months to begin, so any solution to spam on messaging apps will most likely involve a long wait.