March 9, 2004
Technology in Focus features analysis of recent technology news articles, by the consultants in Technology Group, IDA. This is the top pick of the month from a list of 10-20 news analysis compiled monthly.
Premium Rate Spam Scam Hitting Mobiles
by Lee Sze Chin, ENAT Associate Consultant
First Mobile Spam and now Mobile Spam Scam. While receiving unsolicited SPAM messages can be at most annoying, mobile spam scam can leave you with a hefty mobile phone bill.
The scams are designed to dupe the recipient into dialing premium rate numbers or using premium SMS services. Scam can come in various forms; for example a SMS text message reading "I Fancy You". It invites the recipient to identify the sender by calling a premium rate number. And in the recent UK "missed call scam", unethical spammers uses computer-generated calls leave a "missed call" message on a user's handset and capitalises on the curiosity of the recipients.
Mobile spam or scam is old news in Japan where the situation is particularly serious because the operators offer IP-based mobile email service. Mobile email spam are known to trigger some rather nasty behaviour on "smarter" mobile phones, such as dialing the police or premium service numbers when a user clicks on trick URLs. This has prompted NTT DoCoMo, for example, to provide its i-mode users with an in-built email blocking feature that rejects spam mails from i-mode handsets that send more than 200 messages per day. The operator has also set a daily quota of 1,000 messages per handset.
Even though it has yet to be reported, spam using trick URL could be a potentially serious form of mobile spam & scam for the GSM world as well. Spammers can, in theory, embed an URL within a WAP Push message and spam their intended victims. WAP Push messages are simply specially formatted SMS messages containing a URL. The incoming Push message will appear as an alert and if the user clicks on the message, the phone will connect to a WAP page which can have a premium service number embedded in an innocent looking WAP link. Once the user is tricked into clicking on the special link, the phone will dial the premium number and establish a mobile-originated call.
However, whether it is pure mobile spam or mobile spam & scam, anti-spam measures should be put in place to clamp down on mobile SMS spam. In this aspect, the European Union and South Korea have taken the lead; in Nov 2003, the EU enacted a newly digital privacy rules that require companies to obtain consent before they send SMS messages to mobile devices.
The Korean Ministry of Information and Communication (MIC) has announced that telemarketers will be stripped of their business licenses if they send advertising messages to mobile phones without the recipient's prior consent. Unsolicited advertising will not be allowed to be sent after 9 p.m., even after companies get consent from subscribers.
Separately, Vodafone UK has launched a trial service known as VSPAM last year that allows its subscribers to forward any spam they receive to a free number - 87726 or VSPAM on their keypad. Vodafone will then compile a report of all unsolicited messages received by its subscribers and forward it to the Independent Committee for the Supervision of Standards of Telephone Information Services (ICSTIS).
Good news is that mobile spam is unlikely to reach the kind of overwhelming proportion its internet cousin is facing because SMS is not free! It is cheap but not dirt cheap which is in stark contrast to the fixed line internet where millions of bulk mails can be sent for little or no cost. This undoubtedly poses a financial limitation to the ambition of spammers but the downside is operators or regulators might be less reluctant to invest resources into protecting the privacy and interest of normal subscribers.
Some words about the writer
Lee Sze Chin is a consultant with the Technology Group, tasked with the responsibility of identifying, tracking and exploring leading edge enabler technologies in the mobile wireless space. He is currently looking into areas such as Wireless Java, Mobile Web Services and Mobile middleware platform such as OSA/Parlay.
Disclaimer:
The Info-Communications Development Authority of Singapore ("IDA") makes no warranties as to the suitability of use for any purpose whatsoever of any of the information, data, representations, statements and/or any of the contents herein nor as to the accuracy or reliability of any sources from which the same is derived (whether as credited or otherwise). IDA hereby expressly disclaims any and all liability connected with or arising from use of the contents of this publication. This analysis does not necessarily represent or contain the views of IDA nor the Government of the Republic of Singapore and should not be cited or quoted as such. All trademarks are the property of their respective owners. Copyright 2004 Info-communications Development Authority of Singapore. Other than for purposes of circulation WITHIN your organisation/company, this article (or any part thereof) must not be reproduced or redistributed without the prior permission of IDA.