On 29 September 2026 Iran's National Cyberspace Center (NCC) started ranking online service providers by cybersecurity, and it began with bulk SMS companies. According to Mehr News, the first group of SMS providers was handed its results at the launch meeting. They now get one month to fix what the assessors found, then a second assessment, and only after that will the rankings be published for the public.
Most of the coverage reads this as news for the SMS industry. It is at least as much news for anyone who sends login codes, payment alerts or delivery notices through one of those companies, because your users' security is partly the security of a provider you probably picked on price.
What the NCC announced
The details, all from Mehr's report of the meeting:
- The ranking rests on a Supreme Council of Cyberspace resolution that asks the coordinating bodies to assess their sectors every quarter and report to the NCC, and on the cybersecurity promotion document the council approved in Shahrivar 1404 (late summer 2025).
- Four bodies take part: the AFTA center, the FATA cyber police, the Passive Defense Organization and the Maher center (Iran's CERT). Assessments repeat every three months.
- More than 200 indicators were checked. The ones Mehr names are continuity of service, protection of people's data, how much managers and staff know about security, suitable equipment, and regular security testing.
- SMS came first because of how widespread bulk and advertising SMS is, and because of the harm done by unwanted bulk messages and infected links that lead to account hacks. Money and banking providers are next, and the NCC deputy also named energy and transport.
The background is not abstract. In February the NCC hosted a meeting on phishing that, per Mehr, reviewed "the recent case of bulk SMS hacking" and the problem of bulk messages sent through unauthorised access, with the major SMS providers, the regulator and the FATA police in the room.
Why a business that only sends OTPs should care
If an attacker gets into an SMS provider's panel, they do not need your system at all. They can send messages that arrive from the same sender line your customers already trust, with a link to a fake login page. Or they can read the codes passing through. A one-time password is only as private as every system it crosses on the way to the phone.
That is why "which SMS provider" belongs in the same security review as "which cloud" and "which mail server". The NCC list, once it is public, gives you a third-party opinion to put next to the price sheet. It will not tell you everything. Two hundred indicators averaged into a rank hide the detail, so ask the provider for its own result after the first round, and ask which findings it is fixing in the month it has.
Five changes worth making now, before the list comes out
- Separate transactional and marketing traffic. Use a different sender line, and ideally a different account, for login codes than for campaigns. A compromised marketing panel should not be able to send from your OTP line.
- Never put a link in an OTP message. If your codes never contain links, a message from your line that does contain one is a fraud signal you can teach users to spot.
- Keep a second provider configured. One provider is a single point of failure for every login. A tested fallback, even with a smaller quota, saves a day of locked-out users when the first one has a bad week.
- Rate-limit and log on your side. Cap codes per number and per account, and record what you sent and when. When someone reports a strange message, you can then tell whether it came from you.
- Offer something other than SMS. An authenticator app, or a code by email for staff, gives users a path that does not depend on the SMS chain at all. Keep it available for the days when SMS delivery itself is the problem; our checklist for running business systems during an internet shutdown covers that case.
Where FanMail fits
FanMail supports SMS one-time passwords and two-factor login, plus opt-in email-to-SMS notifications, because in this market SMS is often the second factor people will actually finish setting up. We wrote about that choice in SMS login, not just an authenticator app. The flip side is that SMS login makes the SMS provider part of your security perimeter. So the advice above applies to us too: pick the provider deliberately, keep authenticator apps on offer, and read the NCC ranking when it appears.
SMS codes are also not phishing-resistant. A fake page can relay them in real time. A better-ranked provider lowers one risk; it does not remove that one.
Frequently asked questions
Has the NCC published the SMS provider rankings?
Not yet. According to Mehr, providers received their results first and have one month to improve; after a second assessment the results are to be released to the public.
Who carries out the assessment?
Four coordinating bodies: the AFTA center, the FATA cyber police, the Passive Defense Organization and the Maher center. The NCC compiles the results, and assessments repeat every three months.
Which sectors are next after SMS?
Money and banking providers are next on the agenda, and the NCC deputy also mentioned energy and transport.
Should we stop using SMS for login codes?
Not necessarily. SMS is often the only second factor many users will enrol in. Keep it, but separate it from marketing traffic, keep a backup provider, and offer an authenticator app as well.
