Danish
English
German
Humans are naturally wired to resist change. Whether it is a new office desk, a new coffee blend in the machine or a new IT-program, we usually prefer the familiar – the solutions that “just work” and that we trust. That is one of the reasons why SMS has remained one of the preferred communication platforms since the 1990s.
Replacing a technology so deeply ingrained in the minds of both companies and consumers is a big challenge. But the RCS technology is more than just an “upgraded SMS”. It’s a technology that introduces significant security advantages for both the sender and the receiver – and in an era where digital trust is a hot topic, it represents a significant upgrade.
But what makes RCS more secure than traditional SMS?
Security in RCS Business Messaging
To understand the difference in security, we can use physical mail as a metaphor:
- SMS is like a postcard: The message is sent as plain text through the cellular network. Anyone with access to the route can theoretically intercept and read the message. The original SMS is built without encryption or sender verification. Although most professional SMS gateways, including GatewayAPI, ensure data encryption from their own platform to the telecom operator, the messages cannot be encrypted all the way to the recipient’s device. The only validation of the sender relies on the filters, set up by the gateways and operators to try to minimize attempted scams.
- RCS works like a sealed letter: RCS Business Messaging uses Transport Layer Security (TLS). This creates an encrypted “tunnel” between the company’s system and the recipient’s device. All data is protected during transit, reducing the risk of man-in-the-middle-attacks – a well known cyberattack where a hacker secretly intercepts, forwards and maybe alters the communication between two completely unsuspecting parties.
While private RCS communication is mostly End-to-End Encrypted (E2EE), opting for transport-layered encryption for RCS Business Messaging is a strategic choice. It enables a variety of features only possible without the message being completely End-to-End encrypted.
By using encryption in transit, the operators and Google gets the chance to scan the content of the messages to keep out spam and scam. Furthermore, it allows the network to process the interactivity that RCS Business Messaging supports, including call-to-action buttons, chatbots and suggested replies.
Compliance and data sovereignty
The question about who has the rights to access the data is a crucial parameter when talking data security and plays a big role in RCS technology since it is particularly here the platform diverges from SMS.
RCS Business Messaging relies on Google’s infrastructure, via Google Jibe – the universal engine that connects operators and networks across borders, and works as the “distribution hub” for the messages. The operators sign up through Google Jibe and offer RCS messages without building the service from scratch. Google has announced that RCS Business Messaging, through Google Jibe, complies with all GDPR-policies.
However, because all messages must pass through Google’s infrastructure, the data is subject to US law (US Cloud Act), even though the majority of the data is stored and managed within the EU. This specific detail has a major influence on our EU-setup:
At GatewayAPI we offer a dedicated EU-setup, ensuring that all data is stored at a cloud provider (Hetzner) that is physically located in the EU and owned by a company from the EU. Since RCS messages have to go through Google’s global infrastructure it is currently not possible to guarantee the same EU-data sovereignty that remains the standard for SMS and email in our EU-setup. Please note that you can still send RCS messages using the EU setup.
Verification: A shield against fraud
The most significant security update in RCS is the introduction of Verified Senders.
While SMS Sender IDs can be spoofed relatively easily , RCS demands an extensive approval process before a single message can be sent.
When an RCS agent is created through GatewayAPI, the company undergoes a validation process covering:
- Company identity: Verification of domain ownership and official corporate registry data.
- Brand assets: Strict vetting of logos and brand colors to prevent impersonation and look-alike profiles.
- Local operator standards: Since regulatory requirements vary by country, this process ensures compliance with local operator rules and documentation requirements.
The result is the blue verified checkmark that gives the recipients a visual guarantee that the message originates from a legitimate business. This removes the foundation of phishing attacks, as it should be impossible for unauthorized senders to obtain this validation.
Setting up an RCS agent is done in six simple steps via the GatewayAPI-dashboard, where our specialists are ready to assist with the application, including helping with configuring name, use case, region, visual identity, company info etc.
Dive into the details: Get a complete overview of RCS agents and how to register here
RCS security in practice
Theoretical security is essential, but the true value of RCS becomes obvious when looking at the practical use in everyday life. Here are two scenarios where switching from SMS to RCS provides immediate reassurance to the recipient.
- Financial transactions and MFA: When a bank sends an alert regarding a suspicious transaction, RCS eliminates the uncertainty many recipients feel when seeing links in standard text messages. The verified logo and the encrypted connection mean that the recipient can safely interact with built-in buttons such as “Confirm purchase” or “Freeze card” directly in the RCS message.
- Logistics and delivery: The logistics industry is often the target of scams involving fake package updates and customs fee demands. With a verified RCS agent it is possible for shipping companies to deliver updates that are almost impossible to counterfeit. The recipient no longer has to second-guess the validity of a link and can rely on the official brand profile and its built-in interactive features.
Gaps and blind spots
Even though RCS represents a significant technological step ahead, it’s crucial to acknowledge that no technology is flawless. Since RCS is still on the path to become the new global standard, new blind spots are emerging that senders must navigate with care.
The risk of “blind trust”
When RCS is marketed as a significantly more secure platform than the traditional SMS, the risk of a false sense of security occurs. The blue checkmark and its professional visual identity can cause the receiver of the message to develop an uncritical level of trust, throwing common sense out of the window. If a malicious actor were to somehow slip through the cracks and obtain verification, the receiver of the message would be far more likely to trust the scam.
Sophisticated fraud in new technology
The scammers are experts at adapting, and a platform promising high security standards is often an attractive target. The introduction of Rich Media opens the door to new and more complex ways to hide malicious content. Links can be hidden behind high quality pictures, call-to-action buttons or strategically placed suggested replies. That’s exactly why the manual verification process and strict onboarding controls are vital to maintain the integrity of the RCS medium and protect the public.
RCS – the new standard?
The transition from SMS to RCS is the biggest leap in the history of mobile communication. Although new technology always brings new risks, the conclusion is clear: RCS is the most secure solution for both senders and recipients.
By replacing the “postcard” with the “sealed letter,” businesses achieve:
- Transparency through manual verification.
- Protection via TLS encryption throughout much of the process.
- Trust, because the recipient always knows who they are messaging.
However, RCS currently involves a compromise regarding our EU setup, as the additional security layer in the EU setup does not currently cover RCS, since RCS messages must pass through Google’s systems on their way to end users.
If you have any questions about RCS and security, feel free to contact our specialists via the support chat.
