ACMA Authority Member Samantha Yorke joined Ali Moore on ABC Melbourne Drive on 4 May 2026 to discuss the SMS Sender ID Register.
Interview audio
Interview transcript
Ali:
Have you ever got a text from Australia Post? I'll bet you have. Most of us have. Maybe myGov? Any number of companies might be telling you about an order, trying to update some information, maybe an appointment reminder, whatever it is. How do you know it's not a scam? And are you wary about clicking on that link? Well, from the 1st of July, those text messages will come with an ‘unverified’ label, if the company has not officially registered with the Telco and Media Regulator.
So what exactly does that mean? Samantha York is the spokesperson for the Australian Communications and Media Authority. Samantha, hello.
Samantha:
Hello, Ali.
Ali:
So what is the problem that you're trying to address?
Samantha:
The problem we're trying to address is that Australians lost $18 million to text message scams last year. And we know that many text scams pretend to be from trusted businesses or government agencies. And they use the same sender IDs that those trusted businesses use.
So we're establishing a sender ID register, as you mentioned, where companies that are using their company name or some brand that's associated with their company, when they send text messages to their customers, can register those names. And therefore, from the 1st of July, when people receive a text message from a company name, they can feel more confident that it's actually safe to respond and engage with.
Ali:
If it says ‘unverified’, it doesn't necessarily mean it's a scam, though.It just means that they haven't registered, correct?
Samantha:
That's correct, Ali. So from the 1st of July, any text messages that are sent from a sender ID that has not been registered with us will be labelled as ‘unverified’. And what that means is that it could be a scam, or it could be coming from a company that hasn't yet registered their sender ID, but that those messages will all be separated and grouped together and labelled as ‘unverified’.
Ali:
So what do companies have to do to get this sort of tick of approval, if you like?
Samantha:
Well, we're urging all businesses that use these branded SMS sender IDs to get in touch with their telco as soon as possible to register their IDs. Now, for some companies, it could be a challenge to actually get your arms around the sender IDs that you're using because some larger companies are using a lot of these different branded sender IDs. So get your arms around which ones that you use and get in touch with your telco to get them registered by the 1st of July.
Ali:
So does it mean that if you get one, I mean, there's some really, really common ones, the AusPost scams, I think there's been scams around Linkt for, you know, paying your toll on the freeway, that sort of thing. Does it mean that we can be really confident clicking on those links after July?
Samantha:
Well, this is what's so insidious about these scams, Ali, is when they come through, they appear very legitimate to you. And you may well be expecting a package from Australia Post or using Linkt toll roads. So it doesn't appear suspicious. Our hope is that from the 1st of July, there will be a level of confidence that Australians can have when they receive these messages. Look, I will say it's not 100% bulletproof.There could be companies that slip through the net and people will always need to remain vigilant. But we are very much hoping that from the 1st of July, anything that comes through to you with a branded sender ID should be much more trustworthy.
Ali:
I guess the obvious question then is what's your cybersecurity systems like? Because if this system of verification is hacked, then that in itself is going to be a rather large problem.
Samantha:
Absolutely. Look, we've built a process for registering companies that we think is pretty robust. So when a company first contacts their telco to get their IDs registered, they need to go through a process that demonstrates that they have a clear business association with the sender ID. They might hold the trademark in it, or it might just be a very clearly identified brand or label that they use. So there's a number of hoops that businesses have to jump through to get onto the register. So we're hoping that that will weed out bad actors along the way.But look, as with anything, and scammers in particular are very agile criminals. These are not people operating out of a garage. These are very sophisticated criminal syndicates that are operating at global scale. They're very quick to realise when particular countries are onto them and a particular strategy they're using, and they adjust the strategy to try to get around it. So look, I'm not diminishing the challenge of keeping up with this, but we're hoping that our process and our cybersecurity is robust enough to minimise the risk of any cybersecurity incidences.
Ali:
And in the research that you've done, in the work you've done in the lead up to this, what are the worst? I mentioned Australia Post a lot, but is that fair as one of the most common scams? What are the most common that you've heard of?
Samantha:
Well, Australia Post is a very common one, as you've identified, Ali.
I mean, MyGov and Centrelink are obviously very commonly used government services here in Australia are often impersonated by these scammers too. And generally, it's the brands that are the most widely used that the scammers target because they feel they've got more of a chance of the scam being successful if it's a company that somebody's already interacting with. But you find banks being impersonated as well by these scammers, which is why many banks have actually moved to in-app messaging only. And they're communicating with their customers, don't trust anything you receive from us outside of the app, because that is where we communicate with you through. So smaller companies, Ali, that may not necessarily be kind of on everybody's radar as being a risk, they may decide they don't need to register their sender ID and that they might actually just decide to start using a normal phone number, for instance, to message their customers. They might decide it's not worth going through the process to get a sender ID registered because they're just not really at high risk of being impersonated.
Ali:
So this is not mandatory. This is more about, you know, them wanting to, I suppose, make it easier for their customers.
Samantha:
Exactly, exactly. And to establish a trusted communications channel with their customers.
Ali:
Samantha York, thanks for telling us about it.
Samantha: It's a pleasure, Ali. Thank you.