As RCS for Business unlocks massive new revenue potential, MNOs find themselves in a dangerous position: losing the technical control to stop rich media fraud that they are still held liable for.
The RCS for Business channel offers extraordinary potential for revenue growth for MNOs worldwide. However, early warning signs suggest that fraud may pose a risk of financial loss and reputational damage, threatening this opportunity in much the same way it has impacted SMS.
In this blog post, the messaging experts from Openmind Networks examine the fraud landscape of RCS for Business to determine how MNOs can effectively mitigate these risks.
RCS for Business is Not Inherently Secure
While RCS for Business provides a modern foundation with sender verification and transport encryption, these measures alone do not prevent abuse. Fraudsters can still exploit rich media, URLs, and brand impersonation to bypass defenses. The result is a channel that, while more modern than SMS, carries many of the same vulnerabilities, enables the use of rich media to make scams more convincing and harder to detect.
The Risk Shifts Upstream, Accountability Does Not
This is the central dilemma for MNOs. With RCS for Business, operators lose visibility into the content they carry. This shifts the burden of compliance, fraud prevention, and spam filtering to CPaaS providers and Google. MNOs, meanwhile, remain responsible in the eyes of regulators and subscribers, even though they lack the technical ability to monitor or block traffic directly. MNOs lack the capabilities to pre-emptively manage RCS for Business traffic, yet they are ultimately accountable for subscriber complaints and regulatory penalties. This mismatch could result in significant pressure across the ecosystem.
Rich Media Expands the Attack Surface
One of the most significant differences between A2P SMS and RCS for Business is the use of rich media, which creates more opportunities for fraud.
Each of these tactics makes fraud detection more complex and potentially more costly.
The Role of AI in Offense and Defense
Artificial intelligence is increasingly a tool for both sides. Fraud actors use it to generate localized content, morph messages, and evade filters. Defenders, in turn, apply AI to support high-speed, inline detection and reduce the manual workload required to manage the vast traffic volumes of modern networks. However, AI is not enough on its own. Accuracy challenges, retraining requirements, and latency issues mean that human judgment and layered controls are still essential in stopping fraud at scale.
Regulatory Pressure is Rising
Even as operators lose technical control of RCS for Business content, regulators continue to hold them responsible for protecting subscribers. In practice, this responsibility is being pushed onto CPaaS providers and Google, who become the de facto enforcement points. This regulatory mismatch creates pressure across the ecosystem and raises the stakes for all players involved, forcing MNOs to demand verifiable audit trails and rapid enforcement capability from their partners to satisfy regulatory demands.
Openmind Networks recommends a unified, AI-enabled firewall that spans SMS, MMS, and RBM. Such a system would combine URL and image inspection with global threat intelligence to provide consistent coverage across channels. The aim is to give operators and providers the ability to correlate campaigns, detect fraud faster, and share insights more effectively.
The Challenge of Adoption and Fraud
Adoption of RCS will depend not only on the quality of the user experience but also on the ecosystem’s ability to manage fraud effectively. Reduced visibility for MNOs means CPaaS providers and Google Jibe are on the front lines of enforcement, often only after operators receive subscriber complaints. Fraudsters continue to exploit media-heavy vectors, from text-in-images and malicious PDFs to chatbot abuse.
Encryption, while useful for privacy, can also shield spam from inspection. Moreover, processes like KYC and sender registration – similar to 10DLC vetting in the U.S. – reduce spam volumes but do not eliminate the financial damage of fraud.
The Threat Model
Fraud risks in RCS can be grouped into several categories:
1. Financial Fraud, Scams, and Smishing
This category covers the direct attempts to trick users into financial loss or credential theft. While rooted in familiar tactics like smishing, RCS for Business campaigns are significantly enhanced by rich media and verified sender status. Fraudsters leverage convincing images, branded logos, and integrated chat features to distribute malicious URLs or trick victims into giving up PINs, passwords, or credit card details. This shift from plain text to rich, persuasive content makes scams far more effective and user trust much easier to exploit.
2. Unsolicited or Non-Compliant Messages (Spam)
This risk relates to the volume and nature of unwanted traffic that degrades the user experience and violates consumer trust. This includes traditional spam, but also violations of strict jurisdictional rules regarding consent and timing (e.g., quiet hours). Though not always criminal, high volumes of non-compliant messages lead directly to subscriber complaints and regulatory action, placing the MNO’s license and reputation at risk. Processes like sender registration and vetting (similar to 10DLC) can reduce this, but they do not eliminate the issue.
3. Deceptive or Misleading Campaigns
These risks focus on exploiting brand identity and user psychology. Brand impersonation is a critical threat, where fraudsters use legitimate-looking visual assets to mimic a bank, retailer, or government agency, making the scam highly credible. Furthermore, sophisticated campaigns employ manipulative design techniques known as “dark patterns” within the chat interface, steering users toward unintended actions or tricking them into revealing information under false pretenses. This attacks the very trust verified RCS for Business agents are designed to establish.
4. Operational Mistakes by Legitimate Agents
Not all risk originates from malicious actors. Many compliance failures stem from accidental non-compliance by legitimate brands. This can include technical errors (like improper handling of opt-out requests), failure to follow content rules (e.g., violating restrictions on gambling or adult content), or simple platform configuration mistakes that result in messages being sent outside agreed-upon times or without required legal disclosures. MNOs are often held responsible for the resulting negative subscriber experience and regulatory breach, even if the error was operational in nature and occurred upstream at the brand or CPaaS level.
5. Chatbot-Specific Risks
The interactive nature of RCS agents introduces entirely new threat vectors not present in SMS. These include:
- Rogue Bots: Agents designed for a specific purpose being hijacked or reconfigured for malicious use.
- Hijacked Agents: A legitimate brand’s agent being compromised by an external attacker.
- Prompt Injection Attacks: Attackers exploiting the chatbot’s underlying Large Language Model (LLM) by injecting commands or data that cause the bot to deviate from its intended function, reveal sensitive information, or engage in deceptive behavior.
Bottom Line
RCS for Business both widens the attack surface and shifts accountability away from MNOs and toward CPaaS providers. Protecting this channel requires inline, multi-modal, AI-assisted controls backed by human oversight, ideally unified across SMS, MMS, and RBM.
MNOs must demand architectural transparency and concrete metrics on inspection points, false positive rates, and the true cost of operationalizing the solution at scale before committing to any vendor. This is the only way to ensure the promised RBM revenue potential isn’t eclipsed by unacceptable financial and regulatory risk.
To learn more about the topics covered in this article, or to discuss how Openmind Networks can help you navigate the future of RCS for Business, please get in touch or contact our team of messaging experts online here.
