In October 2025, CTIA released Messaging Security Best Practices, a supplementary industry self‑regulatory document supporting Messaging Principles and Best Practices. It covers the full messaging ecosystem including operators, DCA aggregators, CPaaS platforms and message senders, focusing on security risks such as spam messaging, account hijacking, SIM‑device abuse and API‑credential leaks. The document carries no federal legal effect, yet constitutes critical operational reference for risk mitigation, traffic filtering and account‑related enforcement among the three major US mobile carriers.
The document sets out core requirements across six major modules. First, monitoring and interception mechanisms: service providers may block suspicious messages based on risk assessment. Risk indicators include fraudulent behaviour, grey‑route traffic, missing identity authentication and repeated violations against industry standards.
Second, evidence‑sharing collaboration and KYC verification: ecosystem participants shall retrieve only necessary data for traceability when spam incidents occur and respond promptly to legitimate inquiries. CPaaS providers and connectivity aggregators must implement KYC procedures and preserve true‑identity records of senders for post‑incident investigation. User‑facing anti‑fraud outreach is recommended to improve end‑user awareness of smishing attacks.
Third, Email‑to‑SMS scenarios: DKIM and SPF email authentication shall be enforced. Such traffic must comply with opt‑in / opt‑out consent rules; non‑compliant messages are subject to blocking.
Fourth, wireless‑messaging abuse mitigation: rules target misuse from SIM‑boxes, virtual‑SIMs and disposable temporary numbers generating mass spam. Platforms shall monitor mass‑SIM provisioning and anomalous traffic patterns. Abuse sources shall be disconnected from messaging networks; suspected criminal activity shall be referred to law‑enforcement authorities.
Fifth, API‑credential security for CPaaS platforms: API credentials shall be managed in alignment with NIST and FIPS standards. Written agreements are mandatory for third‑party API access. Compromise indicators shall be continuously monitored. Upon detected account breaches, CPaaS operators and senders shall notify each other, suspend compromised accounts and remediate system vulnerabilities. Number spoofing must be strongly mitigated.
The document defines SHAFT prohibited content: sexually explicit material, hate speech, alcohol‑related content, firearms‑related content and tobacco‑related content, all designated high‑priority blocking targets.
