What makes sending SMS globally a hard problem
It is important to ensure SMS sending reliability, especially when SMS is used as an OTP delivery mechanism. At its core, SMS sending reliability relies on 3 things: the sender, the receiver and the SMS content.
Sender
When you receive an SMS, you’ll notice that it can come from either a long phone number, a short code or a familiar business name. In industry terms, these are types of SMS originating identities.
There are 3 types of originating identities:
| Originating Identities | Description | Pros | Cons |
|---|---|---|---|
| SenderID | Pre-registered alphabetical name of sender, usually business name | No additional cost; Easy brand name | Several major markets (including Canada, China, and the United States) don’t support sender ID; Low sending rate (10 MPS) |
| Long Code (or Long Virtual Number) | long phone number, including country code, area code and phone number. e.g. +65 12345678 | Low sending rate (10 MPS) | |
| Short Code | 5-6 numeric sequence e.g. 10987 | Higher sending quota and higher sending rate (100 MPS) | High setup cost and high monthly maintenance cost |
Further Reference: https://docs.aws.amazon.com/pinpoint/latest/userguide/channels-sms-originating-identities.html#channels-sms-originating-identities-sender-ids
Each country has slightly different sending preferences, and have laws that can alter your SMS or stop you from sending to that country. Here’s a taste:
- Doesn’t allow long code: India (IN, +91), Phillipines (PH, +63), Saudi Arabia (SA, +966), Switzerland (CH, +41)
- Requires sending Sender ID: Australia (AU, +61), Belarus (BY, +375), Egypt (EG, +20), Jordan (JO, +962), Kuwait (KW, +965), Phillipines (PH, +63), Qatar (QA, +974), Russia (RU, +7), Saudi Arabia (SA, +966), Sri Lanka (LK, +94), Thailand (TH, +66), Turkey (TR, +90), UAE (AE, +971), Vietnam (VN, +84)
- Does not support Sender ID: Argentina (AR, +54), US/Canada (+1), Belgium (BE, +32), Brazil (BR, +55), Chile (CL, +56), China (+86), Colombia (CO, +57), Costa Rica (CR, +506), Ecuador (EC, +593), El Salvador (SV, +503), Guatemala (GT, +502), Hungary (HU, +36), Liberia (LR, +231), Malaysia (MY, +60), Marshall Islands (MH, +692), Micronesia (FM, +691), Monaco (MC, +377), Mozambique (MZ, +258), New Zealand (NZ, +64), Nicaragua (NI, +505), Oman (OM, +968), Paraguay (PY, +595), Peru (PE, +51), DR Congo (CG, +242), Somalia (SO, +257), South Africa (ZA, +27), South Korea (KR, +82), Turkmenistan (TM, +993), Uruguay (UY, +598), Venezuela (VE, +58)
- India-specific: if you don’t use Sender ID, you will need to use ILDO (International Long Distance Operator), which cost a bit more than if you use a registered Sender ID, and will show up as a random shortcode (unless you purchase a dedicated shortcode). It is also very tedious to register a sender ID.
- Singapore-specific: If you send message to Singapore using a Sender ID that is not registered with Singapore SMS Sender ID Registry (SSIR), then its ID will be changed to LIKELY-SCAM.
Given the long list of preferences and restrictions, here is what AWS recommends (as of 2024):
- Send using Sender ID: Russia (+7), Indonesia (+62), Vietnam (+84), Phillipines (+63), Thailand (+66), France (+33), Germany (+49), Turkey (+90), India (+91), Singapore (+65), Japan (+81), Australia (+61), Austria (+43), Georgia (+995), Madagascar (+261), Greece (+30), Malta (+356), Finland (+358), Serbia (+381), UAE (+971)
- Send using Longcode: Italy (+39), UK (+44), Spain (+34), HongKong (+852), Chile (+56), Netherlands (+31), Switzerland (+41), Ireland (+353), Sweden (+46)
- Just Send: South Korea (+82), New Zealand (+64), Brazil (+55), Malaysia (+60), Mexico (+52), Argentina (+54), Belgium (+32), Peru (+51), South Africa (+27), Ecuador (+593)
Receiver
You should validate the SMS receiver before sending. Here’s some list of things you might want to check, other than basic phone number length sanity check and ensuring it has a country code.
- Russia user might have prefix 8 (the long-distance prefix is “8~“)
- All phone numbers in Argentina (country code “54”) should have a “9” between the country code and area code. The prefix “15” must be removed so the final number will have 13 digits total: +54 9 XXX XXX XXXX
- Phone numbers in Mexico (country code “52”) need to have “1” after “+52”, even if they’re Nextel numbers.
- Make sure to remove any leading 0s or special calling codes. Exception on prefix 0, Italian landline still has prefix 0.
Reference: https://faq.whatsapp.com/1294841057948784/
Content
Some countries require businesses to put their business name as a prefix of any SMS content. Other countries (e.g. China, Vietnam) require businesses to register their message templates before allowing the SMS to be sent by their telco networks. If a business need to support multiple language, this would create a huge administrative burden to register new templates.
This is where it gets confusing: sometimes sending a content that has not been registered can be received by some user but not other users, both in the same country. This is because content rules are enforced at the telco level. I once noticed that a specific telco company in Vietnam refuses to send our OTP SMS in english (but not in chinese even though both chinese and english content slightly differs from our registered template).
It is then much safer, and simpler to standardize any SMS content that a business send and only register those templates in countries the business operate in.
Reporting
To monitor SMS sending reliability, we could listen to asynchronous reports from our SMS provider (in this case, I’ll use AWS End User Messaging as an example). However, this reporting will have some false positive. Why?
After receiving your API request, AWS will forward it to local aggregators in each country, which will then forward to individual telcos. Any of these 3 links can fail silently or block your SMS, without reporting the error back to upstream. In such cases, you receive a report that says SUCCESS but your end user never receive any SMS.
Conclusion
Sending SMS reliably at a global scale requires understanding how SMS are sent. It involves a lot of administrative work: registering templates, providing business information to local authorities, buying and maintaining longcodes and Sender ID. And although SMS API providers provide a lot of convenience, you might want to consider using a secondary SMS provider; just in case us-east-1 goes down.