This guide walks through the 7 pitfalls of deploying a generic API service for mission-critical messaging. By "mission-critical" we are referring to messages that absolutely, positively have to get there and include registration, authentication, password reset, and user-generated messages that are revenue and brand impacting.

1. THINK SMS IS EASY?
Seven Pitfalls to Avoid When
Sending SMS Messages
All it takes is a quick glance at a millennial to know that SMS is huge.
SMS, or text messaging, has become a vital part of nearly everyone’s daily
life and now businesses of all types are realizing that SMS is an ideal way to
directly connect with their customers. Companies are leveraging SMS for a
variety of communications including verification messages, shipment or
appointment alerts, and mass-marketing offers.
Before you sign-up for a generic SMS API service and start sending SMS
messages, let’s get a few things straight:
Mobile instant messaging
is growing at a rate of
37% per year and will
represent some 35% of
messaging traffic in
2016.1
Setting the Stage
1. SMS is not easy. The infrastructure was never intended to reliably
manage the volume of SMS messages sent around the world.
2. There are different types of messages that have varying levels of
urgency and importance. Accordingly, there are also different
end-user tolerances for message delays and failures.
A TeleSign Guide

2. TELESIGN 2
It seems pretty simple. You integrate the API
into your website or set-up a communication
path in your marketing department and start
sending. That’s the easy part, but it is one
thing to send a SMS message, it is quite
another to actually deliver it.
Generic SMS API services serve an important
role in sending SMS messages to a mass
audience (e.g., a marketing campaign) when
there is higher tolerance for message delays
and even dropped messages. For important
user-generated or security messages,
companies have a much higher expectation
for delivery, transparency and speed.
A quality practice is a prerequisite for any SMS
messaging service that needs to deliver
messages anywhere in the world within
seconds of the request.
Authentication codes, important alerts, and
other mission-critical messages require a
higher level of diligence to ensure they get
delivered, every time, and without latency.
This e-Guide will walk you through the seven
pitfalls of deploying a generic SMS API service
for mission-critical messages. For these
messages, you need a specialized messaging
service that includes the systems, processes,
and network connections to optimize delivery
rates and minimize latency on a global scale.
All of the incremental services that bolster
the API are necessary ingredients to mission-
critical message delivery and why the most
visible and recognized web properties trust
TeleSign.
THINKSMSISEASY?ATeleSignGuide
Person-to-Person (P2P) Application-to-Person (A2P)
Both of these types of messages leverage an API call.
Attribute Marketing Mission-critical
Requested by Unsolicited User requested
(opt-in)
Message type Special
offers
Alerts,
authentication,
password resets
Optimal Delivery
Rates
Desired Required
Message
Latency
Tolerated Not tolerated
Website / App
Integration
Minimal Premium placed
on user
experience
<< CONTINUED FROM PREVIOUS PAGE
This table delineates some of the differences between
marketing vs. mission-critical messages

3. TELESIGN 3
IT SOUNDS EASY.
You send an SMS, the other person receives
it, and that’s that. The days of pretending that
you didn’t get an SMS are as dated as
blaming your spam filter on a misplaced
email. Wrong. SMS is hard, delivery is not
easy, and the path to the handset is complex.
Typically SMS messages go through multiple
hops and multiple “middlemen” before
reaching their final destination. These
middlemen also known as SMS aggregators
partner with mobile operators to offer
wholesale SMS services at reduced rates.
Unfortunately, with each additional hop, the
probability of failure increases. Generic API
services often lack direct connections to
mobile operators for any of their routes and
rely exclusively on SMS aggregators to get
the message from
point A to point B.
Without these direct connections, there are
more hops, and each hop creates an
opportunity for failure and makes it more
difficult to troubleshoot if there are delivery
issues.
Mission-critical messaging services can
provide tangible value since they have
invested in the processes to optimize global
delivery. They have deeper relationships with
the telcos and mobile network operators
(MNOs) to quickly course-correct when
delivery issues inevitably happen.
For marketing messages, generic APIs may
be perfectly sufficient. But, for organizations
using SMS for two-factor authentication,
password resets, shipment notifications, and
other business process messaging,
purpose-built APIs coupled with direct
operator connections ensure that messages
are delivered, not just sent.
PITFALL #1
LACKING DIRECT CONNECTIONS ON A GLOBAL SCALE
THINKSMSISEASY?ATeleSignGuide
When a SMS is sent, it can either be
routed directly to the MNO or traverse
across multiple aggregators. Each
additional aggregator means additional
hops and additional points of failure.

4. TELESIGN 4
PITFALL #2
UNDERESTIMATING
THE OPERATIONAL
IMPACT OF DEPLOYING
A GENERIC API
SERVICE
For companies relying on SMS
for user-initiated or authentication
messaging, operational
investments have to be made to
ensure that messages are
consistently and reliably delivered.
These investments are usually not
baked into most SMS API services,
but come standard with most
mission-critical messaging
services. These investments take a
variety of forms, but generally
include the following processes:
Automated Failovers
A systems architecture is required
to automatically switch over to
alternative delivery routes to
operators in real-time if
performance degrades. Individual
messages should be retried
through one or more routes in
response to failures, delays or
other network conditions.
Global Carrier Monitoring
Mission-critical messaging requires
dynamic monitoring of message
delivery across global mobile
operators. Ideally, the provider has
direct access to these operators to
escalate any performance issues
and make necessary routing
changes in real time.
Custom Reporting &
Alerting
Customers increasingly require
24x7 access to transaction history,
billing activity, and traffic reporting.
In addition, real-time alerting can
notify customers when traffic
patterns materially change from
benchmark norms.
Dedicated SWAT teams
When there is a persistent issue
with a specific route or carrier, a
Message Assurance Team can
isolate the problem, identify
trends and course-correct —
often before the operators
themselves identify the problem.
Managing Short &
Long Codes
The right blend of short codes and
long codes will depend on the use
case, the markets, the mobile
operator, the volume of messages,
and a variety of other variables.
Generic API services generally
relegate this management to the
customer while full service
messaging solutions assume this
complexity and oversight.
A final operational consideration is
whether you want to allocate your
scarce technical resources to
managing message delivery. If you
are going to staff message delivery
operations with existing
headcount, what is the operational
cost? For many companies, that
cost is just too high.
The decision to leverage
SMS for your company’s
important business
communications is more
complicated than just
coding to an API.
THINKSMSISEASY?ATeleSignGuide

5. TELESIGN 5
SMS delivery is not guaranteed. In fact,
various studies have shown that around 1%
to 5% of messages are lost entirely, even
during normal conditions, and others may
not be delivered until long after their
relevance has passed. Consequently, it’s
vital to measure delivery rates, especially if
those messages are mission-critical like two-
factor authentication.
Most APIs allow you to process delivery
receipts to determine the status of the
message (i.e., delivered, failed, expired, etc.).
But, some carriers don’t provide delivery
confirmation, or provide them sporadically,
and often there is an incremental charge for
providing delivery receipts.
Moreover, published delivery rates are
usually defined as delivered to gateway,
which more or less means “Hey, we sent the
message.” But, there’s a lot that can happen
to a message when it’s en route. Adding
insult to injury, there have been documented
cases where providers published fake
delivery reports that confirmed a message
was delivered when, in fact, it never was.
In addition to end-user
frustration, undelivered SMS
messages are quite costly.
Companies are charged for
every SMS sent, even if some
of those messages don’t get
delivered. While individual
SMS messages cost just
pennies to send, companies,
who send large volumes of SMS messages
on a daily basis, may end up paying tens of
thousands of dollars for undelivered
messages and never once get alerted.
Generic SMS API services are not in the
business of providing this level of insight and
visibility. For messages that positively,
absolutely have to get to end users, finding a
vendor that will partner with you to optimize
true delivery rates is vital.
PITFALL #3
TRUSTING DELIVERY REPORTS
In the world of phone-based
authentication, companies should
capture completion rates instead of
relying on delivery receipts.
The completion rate is the number of
successful authentications (where the
user correctly inputted the one-time
passcode) divided by the number of
messages sent.
Since authentication messages include
one-time passcodes that the end user
has to enter into the website, companies
can capture actual completion rates.
Completion
Rate
Number of completed
authentications
Number of messages sent
=
THINKSMSISEASY?ATeleSignGuide

6. TELESIGN 6
THINKSMSISEASY?ATeleSignGuide
PITFALL #4
MIXING YOUR MISSION-CRITICAL MESSAGING WITH
SOMEONE ELSE’S MARKETING MESSAGES
A number of emerging generic SMS API
services mix their traffic, pumping critical
messaging and mass-marketing messages
through the same pipe. The problem is that
it can stall or prevent the delivery of critical
messages since every provider only has a
finite amount of capacity available.
For example, when there is a massive SMS
marketing campaign during the Super
Bowl, the delivery pipe can clog and cause
queuing of security messages,
important alerts, and other
user-generated messages.
The other big problem with mixed
traffic is that operators may shut
down certain routes if they
suspect spam. Countries have
different regulations that complicate
deliverability.
India, for example, has a
pervasive Do Not Call list for
SMS messages. In the US,
the Telephone Consumer
Protection Act and the
Controlling the Assault of
Non-Solicited Pornography
and Marketing Act ban many
SMS messages. Often,
security and authentication
messages get lost or delayed
if they are commingled in routes with
mass-marketing messages. Unfortunately,
most customers have little recourse when
this happens.
Within some markets, like India, marketing
messages can only be sent during
specified time periods (e.g., between
9:00am to 9:00pm), while mission-critical
messages can be sent anytime. But, to
have your messages classified as “mission-
critical,” your SMS traffic must be vetted
and deemed allowable. Companies risk
hefty fines if they send marketing
messages outside of these designated
windows. In fact, some operators will
require their clients to sign liability waivers
attesting to the type of traffic being sent.
Security messaging requires the highest
level of on-time deliverability because of
what’s at stake – your brand, your
customers’ identities, and even your
downstream revenues. Businesses need a
SMS platform that does not commingle
mission-critical messages with “Get Rich
Quick” or “Look Younger Now” marketing
messages.

7. TELESIGN 7
THINKSMSISEASY?ATeleSignGuide
PITFALL #5
FORGETTING TO
CONSIDER THE
END-USER
EXPERIENCE
The end-user experience is exceedingly
important and often overlooked by
generic SMS API services. When adding
messaging to your service, make sure to
consider:
Localization: It is a far better and a
more personal experience if you can
deliver SMS messages in the user’s
native languages and dialects. It is not a
trivial exercise to create and maintain
translations of the 80+ languages
and dialects of the world.
Message Encoding: Just because you
have translated your SMS, does not mean
it will arrive in the desired character set.
Double-byte characters need to be
encoded to arrive in the proper format.
Unicode has become a universal standard
for message encoding, but it still needs to
be translated into a protocol that
handsets understand. In Europe, that
protocol is GSM, in Japan that is Shift-
JIS, and most other languages are
covered by UTF-8 and UCS-2.
Long SMS Support: A SMS message
maxes out at 160 characters, and for
languages such as Chinese, the
maximum SMS size is as low as 70
characters. What happens if your
message is over the max amount?
‣ Truncation: Many providers will
simply send the first 160 characters
and drop the rest of the
message. Unfortunately, this
frequently means that critical security
codes or key information is left out of
the SMS.
‣ Simple message
splitting: Some providers
will split the message and
send it in multiple
parts. Customers receive
all the content, but critical
information may be split into
separate messages. This
forces the user to cut and paste
pieces of an email or URL back
together on their mobile device.
‣ Messages Out of Order: When
messages are split they are sent as
separate message packets and can
be reassembled in the wrong order.
Some times, parts of the message go
missing or get delayed.
The best way to avoid these issues is
to use a provider that offers smart
message splitting and long message
support (i.e., splitting, sending and
reassembling messages over 160
characters).
Instead of dropping characters over 160,
long SMS support splits an SMS
message and sends it to the user’s
handset with the instruction to
reassemble the message in order as one
SMS.
In the event that a handset or operator is
unable to reassemble an SMS as one
message, smart message splitting
separates a long SMS without breaking
critical pieces of information, such as
URLs and email addresses. The end user
will receive multiple SMS messages, but
important information will remain intact.

8. TELESIGN 8
THINKSMSISEASY?ATeleSignGuide
User Experience/Interface: For
two-factor authentication and many other
enterprise use cases, you need the entire
experience to integrate seamlessly into
your website and provide straightforward
instructions how the verification process
works. A full-service messaging service
can provide UX/UI best practices that,
when implemented, minimize friction and
end-user frustration.
End-user Adoption: Companies
deploying two-factor authentication need
to develop a compelling messaging
strategy to educate their end users about
the process. When users understand that
these extra precautions are in place to
protect their accounts, transactions and
identities, your brand can be enhanced.
Offering a Voice Option: Offering voice
calls as a complement to SMS isn’t just
about offering your users a choice, it’s fast
becoming a business requirement. In
certain countries, SMS is not as reliable as
voice and a voice call may be the only way
to reach most users in these markets.
Transaction Workflows: Since
authentication and other mission-critical
messaging projects often touch other
departments, it’s a best practice to
diagram how these departments and
resources will be impacted by the
implementation. This is where a dedicated
Client Services team can pay big dividends
by creating integration workflows for
successful internal rollouts.
Generic SMS API solution companies are
not in the business of providing best
practices around the user experience. For
mission-critical or user-generated
messaging thinking through the user
experience will reap tangible benefits in
terms of brand reputation, increased
registrations and customer retention.
<< CONTINUED FROM PREVIOUS PAGE
53% of mobile phone users surveyed
preferred receiving a voice call to an
SMS. Some users may not know how to
use SMS, may not own an
SMS-enabled phone, or do not have
messaging plans and are charged on a
per message basis.2

9. TELESIGN 9
Although API integration is usually
pretty straightforward, support is key when
troubleshooting delivery issues.
Support costs from generic API
services are often overlooked and
more expensive than anticipated.
These API services often include free
email support during business hours,
but charge as much as $5,000 per
month for live 24/7 support.
An online knowledge base or access
to log files is one thing, but when you
are experiencing delivery issues, you
need proactive guidance from a
support agent who is well versed in
the nuances of global SMS delivery.
It’s one thing to be transparent about
outages, quite another to provide
proactive guidance about how your
problem is being resolved.
PITFALL #6
THINKING YOU CAN
GET BY WITHOUT
SUPPORT
Do they charge on a monthly or per-
incident basis?
Do they offer 24x7 support at no
additional cost?
Do they offer integration (on-boarding)
support?
Do they offer proactive alerting or access to
a client portal?
Do they offer SLAs and Service Level
Objectives (uptime, technical support
response times)?
THINKSMSISEASY?ATeleSignGuide
5 Questions About Support
You Should Ask Your
Generic API Provider
1
2
3
4
5

10. TELESIGN 10
Phone-Number Cleansing: When users
enter their phone number in a form, they are
not always properly formatted for delivery in
international markets. Phone numbers often
have to be “cleansed” by adding or
removing leading digits in the phone number
based on the country, city, and message
type (SMS vs. voice):
Phone number cleansing can improve SMS
deliverability by more than 10% in most
markets. It takes some telco expertise,
including a working knowledge of the ever-
changing international policies and dialing
codes, to dynamically auto-correct phone
numbers.
SMS-Enabled Phones: If you are sending
SMS messages to a landline or a non-SMS-
enabled phone, the SMS will simply not get
there. Knowing this can improve
deliverability, reduce the number of message
retries, and improve the overall user
experience.
Porting and Other Roadblocks: It can be
hard to correctly route an SMS to a user
who has ported their number from one
operator to another. Not all SMS providers
can send messages to ported numbers or to
VoIP phones (e.g. Google Voice or Pinger
phone numbers).
Phone number attributes play an important
role in establishing a user’s online identity
and mitigating online fraud. These attributes
are increasingly being used by leading web
properties as part of a risk-based
authentication approach to identify high-risk
phone numbers. Unfortunately, most generic
API services don’t provide any data about
the phone type or cleanse the phone
number, which can collectively have a big
impact on deliverability and user experience.
Having some intelligence about the phone
number — even just the phone type —can
dramatically improve deliverability.
PITFALL #7
NOT KNOWING ANYTHING
ABOUT THE PHONE NUMBER
YOU’RE REACHING
Phone Number Cleansed
Number
Notes
0 44 0 330 808 0081 44 330 808 0081 Remove leading
zero
44 44 330 808 0081 44 330 808 0081 Remove double
country code
54 1151591111 54 91151591111 Append a 9 to the
beginning of phone
numbers for voice
calls to mobile
numbers in
Argentina.
THINKSMSISEASY?ATeleSignGuide

11. TELESIGN 11
THINKSMSISEASY?ATeleSignGuide
PITFALL 1: LACKING DIRECT CONNECTIONS ON A GLOBAL SCALE
Do you have direct connections for my desired routes?
Are you a Mobile Network Operator?
If there is message queuing or dropped messages how do you troubleshoot the issue?
PITFALL 2: UNDERESTIMATING THE OPERATIONAL IMPACT OF DEPLOYING A GENERIC API SERVICE?
Do you have multiple failovers to other carriers if there are performance issues?
Do you dynamically monitor mobile operators in real time?
Do you manage short and long codes, or do I need to manage that globally?
Do you have experienced messaging professional to manage the ongoing complexity and oversight for
mission-critical messaging?
PITFALL 3: TRUSTING DELIVERY REPORTS
Do you rely exclusively on delivery reports to measure performance?
Can you help me track completion rates for my authentication messages?
PITFALL 4: MIXING YOUR MISSION-CRITICAL MESSAGING WITH SOMEONE ELSE’S MARKETING MESSAGES
Do you leverage your messaging pipe for sending mass-marketing campaigns?
Does your service commingle marketing and mission-critical message types?
How
do
you
manage
messaging
in
countries
with
“Do
Not
Call”
laws?
Are
your
short-­‐codes
whitelisted
in
countries
(e.g.,
India)
that
restrict
markeBng
messages?
PITFALL 5: FORGETTING TO CONSIDER THE END-USER EXPERIENCE
Do
you
localize
and
encode
SMS
messages
in
the
languages
of
your
users?
Can
you
provide
best
pracBces
for
website
integraBon
for
authenBcaBon
and
verificaBon
messaging?
Do
you
offer
a
voice
opBon
for
message
delivery?
Can
you
provide
any
guidance
on
how
to
improve
end-­‐user
adopBon
for
authenBcaBon?
How
do
you
handle
SMS
messages
that
are
longer
than
160
characters
in
length?
KEY QUESTIONS
TO ASK YOUR SMS PROVIDER

12. TELESIGN 12
THINKSMSISEASY?ATeleSignGuide
Key Questions to Ask Your SMS Provider
PITFALL 6: THINKING YOU CAN GET BY WITHOUT SUPPORT
Do
you
offer
free
24x7
live
support?
Is
your
support
staff
well
versed
in
SMS
and
troubleshooBng?
Do
you
offer
integraBon
or
on-­‐boarding
support?
Do
you
offer
a
customer
portal
or
proacBve
alerBng?
Do
you
offer
SLAs
or
Service
Level
ObjecBves?
PITFALL 7: NOT KNOWING ANYTHING ABOUT THE PHONE NUMBER YOU’RE REACHING
Do
you
“cleanse”
phone
numbers
to
auto-­‐correct
improperly
formaVed
phone
numbers?
Can
you
detect
whether
the
SMS
is
being
sent
to
a
landline
phone?
Can
you
send
SMS
messages
to
ported
or
VoIP
phones?
<< CONTINUED FROM PREVIOUS PAGE

13. TELESIGN 13
Deploying a generic API-based solution is never just a “set it and forget it”
proposition. The complexity of global mobile communications requires
both real-time monitoring and troubleshooting for critical SMS
messaging. This requires dedicated operational resources, carrier
connections, and organizational focus to address delivery problems when
they occur. And they will occur.
If you don’t have a surplus of skilled telecom
professionals, you may need to revisit this decision to
go it alone with a generic API service without the
supporting monitoring and data services.
TeleSign addresses these pitfalls head-on with a
commitment to:
‣ Providing crucial services, built around the
messaging API, to optimize global message
delivery
‣ Reducing the points of failure by eliminating the number of message hops due to our
direct carrier connections
‣ Isolating and troubleshooting delivery issues rather than relying solely on delivery receipts
at face value
‣ Sending ONLY mission-critical messaging and not commingling traffic with low-quality,
high-volume marketing messages
‣ Focusing on the customer experience with intuitive website and app integration services,
localized messaging and encoding, and multiple messaging modes (SMS and voice)
‣ Supporting customers and developers, 24x7x365, at no additional expense with
experienced messaging professionals
‣ Providing mobile data associated with a phone number (e.g., the phone type) and phone
number cleansing services to boost deliverability
Closing Thoughts
THINKSMSISEASY?ATeleSignGuide
At TeleSign, we’re experts at
authentication, and to do that we had
to become experts in global
messaging. While there’s a messaging
API at the heart of our services,
TeleSign layers on additional services
and processes to ensure reliable and
timely messaging on a global level.

14. TELESIGN 14
Every second, of every day, TeleSign protects the world's largest Internet and Cloud
properties against fraud. TeleSign's security and authentication products provide an
easy-to-implement and powerful method for identifying and substantially reducing
online fraud and spam. The company protects 2.5 billion downstream accounts in
more than 200 countries and territories, offering localization services in 87 languages
and dialects. In 2012, TeleSign ranked #23 on the Deloitte Technology Fast 500™
and was named Visionary in Gartner's User Authentication Magic Quadrant. TeleSign
is a Summit Partners backed company.
For more information about TeleSign, visit www.telesign.com.
About TeleSign
Sources:
1 Informa Telecoms & Media, Despite incursions from OTT providers of IM services, SMS retains dominance in
messaging revenues and traffic through 2016 (April 2012)
2 Pew Internet and American Life Project on Americans and Text Messaging (September 2011)
THINKSMSISEASY?ATeleSignGuide