Verified sender programmes let a brand display a trusted, verified identity — name, logo and badge — instead of an anonymous sender string. RCS uses Verified Sender / verified business agents, SMS uses registered sender IDs, and email uses a VMC certificate published via BIMI. Each ties the displayed brand to a vetted registration, so recipients can distinguish genuine senders from spoofers.
- Submit your KYC packTrade licence, authorisation letter and sample messages
- BroadNet files the applicationWith the operators or the regulator, as the market requires
- Review and approval
- Send under your brandYour approved sender ID on every message
Why sender identity needs verifying
Messaging channels historically let a sender choose almost any identity: an SMS alphanumeric sender ID is just a string, an email From address is self-asserted, and neither is authenticated on the wire. That openness is exactly what phishing and smishing exploit — a fraudulent message that shows a bank's name or logo is indistinguishable, to the recipient, from a real one. Verified-sender programmes close that gap by binding the identity the recipient sees to a registration the platform has vetted, and by displaying a visible trust signal (a verified badge, a brand logo) that a spoofer cannot reproduce. Across RCS, SMS and email the mechanisms differ, but the goal is the same: make the displayed brand provable.
RCS Verified Sender and verified business agents
On RCS, the business identity is the agent, and a verified agent is one the operator and MaaP platform have vetted through brand verification before provisioning. A verified agent presents the brand's name, logo, brand colour and a verified badge in the native messaging client, and the client can surface additional business information (description, website, contact details). Because the verification is anchored in the operator/MaaP chain rather than self-asserted, a subscriber can trust that a badged RCS agent is the real brand. This is why RCS is positioned as a phishing-resistant channel: the rich, branded identity is verified, so a spoofed look-alike cannot obtain the badge.
| Channel | Verified identity | Anchor of trust |
|---|---|---|
| RCS | Verified business agent (name, logo, colour, badge) | Operator + MaaP brand verification |
| SMS | Registered sender ID (alphanumeric / short code) | Operator / GSMA sender-ID registry |
| Verified business (display name, green badge) | Meta business verification | |
| Brand logo shown next to the message | VMC certificate published via BIMI |
Sender-ID registration for SMS
For SMS the identity is the originating address — an alphanumeric sender ID, a short code or a long number — and in a growing number of markets these must be registered before traffic is accepted. Registration links a sender ID to a verified legal entity in an operator or GSMA-aligned registry, so unregistered or mismatched sender IDs can be blocked or overwritten at the network edge. Regulations vary widely by country: some enforce pre-registration and whitelisting, some reserve alphanumeric IDs entirely, and some substitute a generic identifier for unregistered A2P traffic. A messaging platform reconciles each destination market's sender-ID rules before routing, because an unregistered sender in a strict market is simply dropped.
VMC and BIMI: verified logos in email
Email's branded-sender scheme is BIMI (Brand Indicators for Message Identification), which lets a verified brand logo appear next to its messages in supporting mailbox providers. BIMI is not a standalone trust claim — it is layered on top of email authentication. A domain must first pass SPF and DKIM and enforce DMARC (a policy of quarantine or reject), then publish a BIMI DNS record pointing to the logo and, for the providers that require it, to a Verified Mark Certificate (VMC). A VMC is issued by an authorised certificate authority only after verifying that the organisation owns the trademark for the logo. So the displayed logo is backed by both domain authentication and a trademark check — a spoofer who cannot pass DMARC or hold the trademark cannot show the mark.
; DMARC must be at enforcement first
_dmarc.brand.example. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@brand.example"
; BIMI: l = logo (SVG Tiny PS), a = VMC evidence (PEM)
default._bimi.brand.example. TXT "v=BIMI1; \
l=https://brand.example/logo.svg; \
a=https://brand.example/vmc.pem"Anti-spoofing and anti-impersonation in practice
Verified identity only helps if the unverified path is also policed. Effective anti-impersonation combines three moves: display a verifiable identity on the legitimate channel (verified agent, registered sender ID, BIMI logo); authenticate origin so forgeries fail (DMARC enforcement for email, sender-ID registration and edge filtering for SMS, the operator/MaaP chain for RCS); and monitor for look-alikes (homoglyph sender IDs, cousin domains, brand terms in unverified traffic). Because attackers pivot to whichever channel is least protected, a brand raises its verified posture across every channel at once rather than one at a time — the same logic that treats messaging trust as a cross-channel programme rather than a per-product setting.
| Risk | Example | Control |
|---|---|---|
| Sender-ID spoofing | SMS shows a bank's alphanumeric ID | Sender-ID registration + edge filtering |
| Look-alike sender | Homoglyph or near-match brand string | Registry vetting + monitoring |
| Email spoofing | Forged From on the brand's domain | SPF + DKIM + DMARC enforcement |
| Logo/badge forgery | Fake brand logo in the client | VMC/BIMI (email), verified agent (RCS) |
| Channel pivot | Attacker moves to the weakest channel | Verified identity on every channel |
Frequently asked
What is a verified sender?
A verified sender is a brand whose displayed identity — name, logo and a trust badge — has been vetted and bound to a registration by the platform, rather than being a self-asserted string. RCS uses verified business agents, SMS uses registered sender IDs, WhatsApp uses verified businesses, and email uses a VMC published through BIMI.
What is RCS Verified Sender?
It is the RCS mechanism that vets a business agent through operator and MaaP brand verification, then displays the brand's name, logo, colour and a verified badge in the native messaging client. Because the badge is anchored in the operator chain and cannot be self-asserted, a spoofed look-alike cannot obtain it, which is why RCS is treated as phishing-resistant.
What is sender-ID registration?
It is the process of linking an SMS originating address (alphanumeric ID, short code or long number) to a verified legal entity in an operator or GSMA-aligned registry, so unregistered or mismatched sender IDs can be blocked or replaced at the network edge. Rules vary by country, from strict pre-registration and whitelisting to reserving alphanumeric IDs entirely.
What are VMC and BIMI?
BIMI (Brand Indicators for Message Identification) lets a verified brand logo appear next to email in supporting mailbox providers. It requires the domain to enforce DMARC and publish a BIMI DNS record, and many providers also require a VMC (Verified Mark Certificate) — issued only after a CA confirms the organisation owns the logo's trademark.
Why does BIMI require DMARC enforcement?
BIMI displays a logo as a reward for a domain that is provably protected against spoofing. That protection is DMARC at enforcement (a policy of quarantine or reject) on top of passing SPF and DKIM. Without enforced DMARC a spoofer could forge the domain, so mailbox providers only show the BIMI logo once forgeries are already being rejected.
How do verified-sender controls stop impersonation?
They combine a verifiable displayed identity on the legitimate channel, origin authentication so forgeries fail (DMARC for email, sender-ID registration and edge filtering for SMS, the operator/MaaP chain for RCS), and monitoring for look-alike senders and domains. Because attackers pivot to the least-protected channel, brands raise verified posture across every channel at once.
Source specifications
The published standards this page is grounded in. Opens in a new tab.