What never to put in a transactional SMS: passwords, full card numbers and private details

The short answer: in a transactional SMS, never include passwords, PINs, full card or account numbers, ID document numbers, health details or other private information. The SMS shows on the lock screen, stays stored on the phone, and the number may change hands. Give only enough for the customer to recognise the matter, and send the rest somewhere behind a password.

Why SMS is not a safe

1	It shows on the lock screen. Anyone nearby can read the preview without unlocking the phone.

2	It stays stored. The message sits on the phone until someone deletes it, and phones get lost, lent or sold.

3	Numbers change hands. A customer who stopped using a number may no longer be the one receiving it.

4	Phones are shared. In many families the same handset passes through several people.

Instead of this, write this

Instead of	Write
The new account password	«Your password was changed. Not you? Call [PHONE].»
The full card or account number	Only the last 4 digits: «account ***4521».
A medical test result	«Your results are ready. Please collect them at the clinic.»
The balance, when nobody asked for it	The operation and its amount; the balance is on your website or app.
The ID document number	The first name, if needed, and the case reference.

Verification codes are a different matter. A code the customer asked for can go by SMS, with a short expiry and limited attempts: see sending one-time codes safely. What you never do is send a code or a password the customer did not ask for.

What the API already does for you

In API answers, the recipient's number comes masked, like 25884****567, so it is not kept in full in your system's logs. Requests always travel over HTTPS, and each key can have an IP list. The message text is down to whoever writes it: whatever you put in arrives on the phone exactly as written.

Before a new text goes into your system

1	Read it as if the phone belonged to someone else. Would they learn something they should not?

2	Remove whatever is not needed for the customer to understand the matter.

3	Swap the sensitive detail for a pointer: «see your account on our website», «collect at the clinic», «call [PHONE]».

Guard your API key just as carefully. Keep it in a vault or an environment variable, never in the code. If it leaks, follow what to do when a key leaks.

Want useful notices that never expose your customers? See Transactional SMS.

See Transactional SMS

Categories

Categories