India's SMS scrubber launch erased OTPs and broke 40% of commercial traffic

On March 8, 2021, India's telecom operators implemented Trai's new regulations for commercial text messages: a blockchain-based system that verifies every commercial SMS's sender ID (header) and content template against a registered record before delivery, and simply blocks messages from unregistered sources. By Monday evening, around 40% of the one billion average daily commercial SMS deliveries had been disrupted, and among top private and public sector banks the failure rate was over 25%.

The blast radius was the whole OTP economy: netbanking, credit card payments, UPI and Aadhaar-enabled payments, railway bookings, e-commerce checkouts and new-customer registrations all failed as one-time passwords never arrived — even Co-WIN registrations needed for Covid-19 vaccinations. IRCTC tweeted that e-ticketing SMS would be impacted; the Aadhaar portal told users it could not reach an authentication service. 'We have been unable to onboard new customers which require two-factor vetting,' said an executive at a mid-sized payments company.

Each side blamed the other. Payments companies and banks called the implementation faulty; the Cellular Operators Association of India said due process was followed and that operators had repeatedly asked principal entities to register content templates before March 7. Trai said constant reminders had been sent for 15 days, and a senior telecom executive pointed to the Delhi High Court's order for speedy implementation: 'Despite abundant time given to companies, if they are still cribbing about not being prepared, it is not our fault.'

About 40% of one billion daily commercial SMS deliveries disrupted; failure rates over 25% at top banks; UPI, Aadhaar and Co-WIN signups hit.

Every commercial SMS now had to match a registered header and template, and messages from unregistered sender IDs were simply blocked.

Large parts of the banking, government and e-commerce ecosystem had not registered their sender IDs and templates by the deadline.

The go-live fell on a Monday — the week's highest-traffic day, as industry executives complained — rather than a weekend.

The Indian Banks' Association sought an immediate postponement from Trai and RBI; none came, and the filter switched on as scheduled.

Enforce a new filter on the highest-traffic day with critical senders unregistered, and you haven't launched a policy — you've launched an outage.

As disruptions mounted, the Indian Banks' Association reached out to both Trai and the RBI seeking an immediate postponement of the regulation. The regulator said it had received no official complaint about any disruption and that reminders about the impending deadline had gone out for the previous 15 days.