According to SoftBank's coverage of the JPAAWG meeting, Japan's four major mobile operators — NTT Docomo, KDDI, Rakuten Mobile, and SoftBank — are jointly strengthening protection against SMS phishing scams. The carriers are working to reduce the risk of users clicking on forged links, disclosing personal information, or installing malware by taking measures such as enabling risk SMS filtering by default, sharing threat intelligence, identifying infected terminals, and promoting common short codes and official RCS accounts.
SMS phishing scams typically impersonate courier services, financial institutions, or communications service providers, luring users to click on links with pretexts such as "abnormal package status", "account verification", or "payment failed". Some attacks are not carried out by scammers directly sending mass messages; instead, they first infect ordinary users' mobile phones with malware, then remotely control the infected devices to continuously send forged SMS messages to contacts in the address book or other numbers. Since message content, links, and sending numbers can be changed frequently, relying solely on keyword blocking or user-initiated number blacklisting is no longer an effective countermeasure.
The four operators have successively rolled out default-enabled risk SMS filtering since around 2022. As this mechanism requires a balance between protecting communication confidentiality and blocking fraud, the carriers held ongoing discussions with Japan's Ministry of Internal Affairs and Communications regarding legal boundaries and implementation conditions. Network-side filtering can prevent some high-risk SMS messages from reaching users, but it cannot guarantee the identification of all fraudulent content, and legitimate messages may be misclassified.
NTT Docomo has gone further by proactively sending alerts to users "sending abnormal SMS messages", notifying them that their devices may be infected with malware. SoftBank, for its part, sends warning messages to users with abnormally high daily SMS volumes. Operators have observed that such alerts can, in some cases, reduce the continued outward sending of abnormal SMS; however, if malicious applications have seized default SMS permissions, users may not see the alerts, necessitating alternative outreach methods such as written notification.
The industry is also promoting "common SMS numbers" and official RCS accounts. Common numbers issued after carrier verification help users confirm the identity of enterprises; RCS, meanwhile, can display enterprise names, logos, and verified badges. Carriers also advise enterprises to avoid using free short links, clearly disclose the sender's identity, and work toward establishing more unified rules for enterprise SMS sending.
