Text messages and RCS messages are effective tools for business communication. However, their security doesn’t happen on its own. Thomas Wahlberg, CTO of Quriiri, points out that even small oversights can open the door to misuse. With the right choices, however, it’s possible to make communication extremely secure.
We asked Thomas what things companies should consider when messages are sent via an API or a browser-based user interface.
1. Web forms: the most common attack vector
Abuse often starts in a simple place: a web form where a user enters a phone number.
A typical attack proceeds like this: a hacker finds a form that sends an SMS to the entered number, for example, for phone number verification. Thousands of foreign numbers are automatically entered into the form, and the messaging costs start to rise.
Thomaksen's advice for securing forms:
- Restrict the acceptable countries only to those that are actually needed.
- Add validations and usage restrictions to the forms.
- Consider CAPTCHA protection.
- Take advantage of Quriiri's land and communication rate limiters.
2. Strong passwords and two-factor authentication
If a criminal manages to send messages in your company's name, the consequences will be visible in both costs and reputation. A strong password and two-factor authentication remain the most effective protection.
”The recommendation is a password of at least 16 characters. Two-factor authentication, preferably using an authenticator app, is the best way to protect against password leaks and cracking.,”, Thomas says.
In addition to passwords, you should ensure that old user accounts are deleted and access rights are kept up to date.
3. API keys: keep them strictly under control
API keys determine who can send messages on behalf of your organization. Protecting them is at least as important as protecting user credentials.
Thomak's practical instructions:
- Do not share API keys in chat applications, email, or during screen sharing.
- Name the keys descriptively so they are easy to identify and revoke if necessary.
- Remove unused keys regularly.
- Restrict key visibility to those with a genuine need.
”A leaking API key is difficult to detect. It can be exploited systematically, for example, for mass mailings conducted at night, where the damage can quickly grow to be significant.,”Thomas says.
4. IP address restrictions: allow calls only from known sources
One of the most effective ways to secure an API integration is to restrict the IP addresses from which API calls are accepted. In Quriiri, you can specify the allowed IP addresses directly in the settings.
In practice, this means that even if the API key ends up in the wrong hands, the request will be rejected if it comes from an unknown address.
If the field is left empty, calls are allowed from all IP addresses. Limiting should be done whenever possible.
Quriiri supports both IPv4 and IPv6 addresses, as well as CIDR notation for specifying subnets. Multiple addresses can be separated by commas or line breaks.
5. Boundaries and Limiters: Prevent Damage Before It Happens
Quriiri offers several tools that can be used to prevent misconduct before it occurs.
Ground-level borders
If your company sends messages only within Finland, it’s a good idea to block numbers from other countries entirely. In Quriiri, international numbers are blocked by default. The most common cases of abuse involve mass text messages sent to expensive international numbers, where the cost of a single message can be tens of cents.
Message budget limits
Daily, weekly, and monthly limits are one of the most effective ways to limit damage in a situation where messages are sent without authorization.
”The greatest damage usually arises from malicious traffic continuing for a long time. By setting the limits to match the normal message volume, potential damage can be minimized. Criminals operate systematically and often time their sabotage for weekends or nighttime. The limits also protect against human errors and programming mistakes.,” says Thomas.
6. Sender ID: luvita and protect if necessary
The reliability of text messages is based on the recipient's ability to identify the sender. Falsifying sender information has been a common method in scams, which is why the rules of the game have changed.
Traficom Regulation 28 L/2025 M entered into force on May 4, 2026. It applies to SMS, MMS, and RCS messages and requires companies to ensure they have the right to use the Finnish phone number or alphanumeric sender ID they use. If sender information cannot be verified, the ID will be changed or message delivery will be blocked entirely.
Additionally, a company can protect its alphanumeric sender ID by registering it with Traficom. Registration grants exclusive rights to the ID and prevents others from using the same name.
Authentication and protection are not just about compliance. They directly affect whether the message appears trustworthy to the recipient and whether it actually gets delivered.
7. Be prepared: what to do if something happens?
Even if everything has been done correctly, risks cannot be completely eliminated. That is why it is a good idea to think in advance about how to act in a problem situation.
Practical questions that are worth answering in advance:
- What should be done if an API key leaks?
- Who is cutting off the connection?
- Who is notified of the situation and how?
”A quick response is often the factor that separates a minor annoyance from a real crisis,” Thomas summarizes.
8. Unicode or GSM: don't let character encoding surprise you
If a message contains even a single Unicode character, the entire message is treated as a Unicode message. In this case, fewer characters fit into a single message, and the same content may require multiple messages. This is reflected in the costs.
A Unicode character can slip into a message unnoticed, for example in copy-paste text from documents or AI tools, a dash, or the wrong form of a space character.
The Quriirin user interface displays a warning about this when writing a message. When sending via the API, it's a good idea to check this separately.
RCS is a safer channel
RCS is not only a visually richer messaging channel. It is also harder to abuse.
”RCS agents always undergo a strong background check by the operator. Therefore, abusing them is considerably more difficult than regular SMS,”, Thomas says.
When using RCS with SMS fallback, messages reach all users and the security level remains high.
Summary
Secure communication is built on small, concrete actions:
- limitations, limiters and validations
- strong passwords and two-factor authentication
- Managed use of API keys
- IP address restrictions: allow calls only from known sources
- approved and, if necessary, registered sender IDs
- contingency plan for emergency situations
When these things are in order, corporate communication is considerably more difficult to misuse and customer trust is maintained.
Do you want to know more about SMS or RCS messages? Contact us!
