Where Did My SMS Go? Part 1: Why A2P delivery receipts can't be trusted
An SMS delivery receipt (DLR) carries no proof of who wrote it, so any intermediary in the A2P SMS supply chain can fake one. This practitioner article explains why fake DLRs are profitable under submission-based billing, why today's statistical and sample-based defences cannot identify which message was faked or by whom, and how voice (STIR/SHAKEN) and email (DKIM, ARC) solved a similar problem with signatures that travel with the message. It proposes a receipt signed by the destination operator plus a signed chain of intermediaries, and reports a field test showing that an unknown 500-byte TLV passed a production SMPP platform unchanged. Part 1 of 3.
Authors
- Mehdi Gholami
Publication Details
- Journal
- Zenodo (CERN European Organization for Nuclear Research)
- Published
- 2026-10-27
- DOI
- https://doi.org/10.5281/zenodo.23684042
- Primary Topic
- Spam and Phishing Detection
- Type
- preprint