Quick access:

• Preamble
• What is the new Brand Authentication+ verification process?
• What is the exact impact for me?
• Why is this new process introduced?
• Reseller advice
• Related material

Preamble

The Campaign Registry (TCR) is introducing on October 17th, 2024 (tentative) a new brand verification process named "Authentication+" for public profit brands. This new process aims at preventing the risk of 10DLC brand impersonation, by requiring a 2FA email verification to be completed for all new and existing public profit brands.

This new process will introduce new brand attributes and changes to the brand verification flow. Therefore, this feature is considered a breaking change and may require you to take some action to avoid disruption.

What is the new Brand Authentication+ verification process?

Brand verification process (without Authentication+)

When verifying a 10DLC brand without the Auth+, the brand information is used by a third party vetting provider to confirm the existence of the legal entity in the corresponding country of registration. Once confirmed, the brand identity status becomes 'Verified'.

• Alternatively, when registering a U.S. or Canadian Sole Proprietor entity, the brand details are compared to existing 10DLC brand records and a mobile phone number is required to complete an SMS 2FA verification. Upon 2FA verification, the brand identity status becomes 'Verified'.

Brand verification process (with Authentication+)

When registering a brand requiring the Authentication+ level of verification, the brand is identified and the vetting provider could confirm the existence of the legal entity in the corresponding country of registration.

• A new 'verification email' is checked, to confirm if it can be associated with the brand. When this is done, a verification email is sent. Please make sure to provide the email address of a trusted employee of the brand being registered, and that this individual is aware of the registration.

The Campaign Registry (TCR) sends an email to the 'verification email' address, containing a URL (link) and a PIN code. When the trusted employee clicks on the link, they are taken to a portal where they must provide their first and last name, job title, and the PIN code received in the email if it is missing from the field. When the employee submits the form, the verification is complete and the brand identity status becomes 'Verified'.

Updates to the brand information

Two new attributes are created

1. Verification email ('verification_email' on the API)
   This is the email address of a trusted employee of the legal entity being registered
2. Verification email - Completion date ('verification_email_completion_date' on the API)
   This relates to the date of completion of the Authentication+ verification process

Important information

• This process is being rolled out only to new and existing public profit brands on Oct. 17th 2024, but TCR and the carriers aim to expand this verification process to all brands in the future
• The new Authentication+ process complements the existing brand verification process, it does not provide more capabilities or throughput rates than the current process
• TCR will send only one 2FA verification email per "verification email" address in a two hour window (this is to avoid risking the TCR sender email address being flagged as SPAM)
• If your brand fails the basic verification via the vetting provider, if the verification email cannot be associated with the brand, or if the trusted employee does not complete the 2FA email verification within 30 days, the brand identity status will be set to 'Unverified'
  
  • A new verification must be requested (i.e. a fee of $4 for the brand verification will be applied)
• TCR will no longer authorise 'Unverified' brands to request an external vet as a mitigation for failing to verify the brand
  
  • First, ensure the brand details match the official records in the country of registration
  • Then, submit a new verification request
    We are working with our partners to set up other mitigation mechanisms
• TCR will not charge the first re-verification attempt for existing brands at this time
  • TCR already announced planning to update the brand registration fee when they will expand the scheme to additional brand entity types 

What is the exact impact for me?

Registering a new 10DLC brand

When you register a new public profit brand, you will be required to provide a new 'verification email' address, corresponding to a trusted individual associated with the brand being registered. This email address must match the domain name of the company's employees, and must be a specific & individual address (distribution lists or team addresses are not allowed). Make sure that this individual is aware of the brand being registered within the 10DLC ecosystem, and that an email will be sent to them from The Campaign Registry (TCR). 

Note that:

1. TCR will only send 1 email within a two hour period to the same email address
   This is to avoid being flagged as SPAM
2. The verification email sent to the employee contains a link and PIN code
   This email will be valid for 7 days
3. A new verification email can be sent to the verification email address if expired
   Note that there is a 30 days deadline before which the verification must be completed
4. Failing to complete the process within 30 days will set the brand to 'Unverified'
   A new brand verification must be requested to verify the brand
   If using our API endpoints, a request must be sent to our POST /brands/:brandId/revet endpoint

Updating existing 10DLC brands

If you already have public profit brands, your brands (and its campaigns) will not be impacted until a deadline (which will be communicated by TCR at a later date) is passed.

You will need to update each of your existing brands, and provide the new 'verification email'. This will set the brand identity status to 'Unverified', requiring you to re-verify the brand.

If you are using our APIs, you will need to trigger this new verification by sending a request to our POST /brands/:brandId/revet endpoint. The new brand verification process (including Auth+) will apply. Once completed, your brand identity status will revert to the previous status ('Verified' or 'Vetted Verified').

Note that:

1. Re-verifying your brand is required to register new campaigns for that brand
2. Existing campaigns will remain active, able to link numbers and send traffic before the deadline
3. Failing to complete the process within 30 days will set the brand to 'Unverified'
   A new brand verification must be requested to verify the brand
   If using our API endpoints, a request must be sent to our POST /brands/:brandId/revet endpoint
4. The first attempt to re-verify your brand will be free of charge, subsequent requests will cost $4
5. Changing any other brand information during the update will void any existing vet for that brand
   Once verified, the brand identity status will be set to 'Verified'
   A new external vetting request will be required to unlock campaign use cases and throughput

Why is this new process introduced?

The Campaign Registry (TCR) is introducing this new brand verification process to prevent brand impersonation, which leads to fraud such as disinformation, smishing and spoofing. This new process will require the involvement of a representative of the brand, who will need to complete a 2FA / brand attestation step to allow campaign registrations. Initially, the new verification process will only apply to public profit brands, but the scheme is expected to expand to other brand entity types in the future.

Reseller advice 

If you are one of our trusted reseller partners, you will need to make sure that the trusted individual representing the brand is aware of their email address being used as 'verification email', and that they understand that the brand registration will not be completed if they do not take the appropriate action in a timely manner. We recommend you to be transparent with your customers as to the operation being performed and the reason for the need to register a specific brand when using your product & services.

Related material

You can find below a video made by The Campaign Registry (TCR), to explain the new feature. Please be aware that we have not implemented the feature exactly the same way TCR did, which means that you will see some discrepancies within the video.

Please reach out to your Account Manager or open a support ticket if you have any further questions related to the information presented in this article.