How Carriers Filter SMS

Every SMS message sent through a US mobile carrier passes through multiple layers of filtering before reaching the recipient's handset. These systems operate independently at each tier of the delivery chain, meaning a single message may be evaluated and potentially blocked at any point between the originating application and the destination device. Understanding how these filters work is essential for maintaining high delivery rates and avoiding silent message drops.

The Multi-Layer Filtering Stack

SMS messages do not travel directly from a sending application to a carrier. They pass through a chain of intermediaries, each with its own filtering logic:

1. CPaaS platform (e.g., Twilio, Bandwidth, Sinch) -- applies content policies, rate limits, and 10DLC compliance checks before the message leaves the platform.
2. Aggregator / interconnect -- upstream carriers and message aggregators apply their own content scanning and velocity rules as messages transit between networks.
3. Terminating carrier (AT&T, T-Mobile, Verizon) -- the final and most consequential layer. Carriers operate proprietary filtering systems that make the ultimate delivery decision.

A message can be accepted at the CPaaS layer but silently dropped by the terminating carrier. CPaaS delivery receipts may still show "delivered" even when the carrier has filtered the message, because confirmation semantics vary by carrier and interconnect.

Content-Based Filtering

Carriers analyze message content using a combination of static rules and dynamic pattern matching.

Keyword Detection

Certain words and phrases trigger elevated scrutiny or automatic blocking. These include terms commonly associated with:

• Financial scams ("free money," "guaranteed loan," "act now")
• Phishing ("verify your account," "click here to confirm," "suspended")
• Illegal goods and services
• SHAFT content (sex, hate, alcohol, firearms, tobacco) sent without proper campaign registration

Keyword lists are not published and change frequently. Carriers deliberately keep them opaque to prevent evasion.

URL Scanning

Messages containing URLs receive additional analysis. Carrier systems check links against:

• Known phishing and malware domain databases
• URL shorteners (bit.ly, tinyurl.com, etc.), which receive heightened scrutiny because they obscure the destination
• Newly registered domains, which correlate strongly with spam campaigns
• Domains previously associated with filtered messages

Some carriers expand shortened URLs and follow redirects to evaluate the final destination. Including a URL from a domain with no sending history significantly increases filtering risk.

Pattern Matching and Template Detection

Carriers maintain databases of known spam message templates. Filtering systems use fuzzy matching to detect messages that resemble these templates even when individual words are changed. Techniques include:

• Shingling -- breaking messages into overlapping n-gram sequences and comparing against known spam
• Normalization -- stripping formatting tricks like zero-width characters, Unicode substitutions (e.g., "fr33" for "free"), and excessive punctuation before analysis
• Structural similarity -- matching message structure (greeting + offer + URL + urgency) regardless of specific wording

Velocity and Volume Analysis

Carriers monitor sending patterns in real time and flag anomalous behavior.

Messages-Per-Second Thresholds

Each sender type has implicit throughput limits. Exceeding them triggers automatic throttling or blocking:

• Unregistered local numbers -- as few as 1 message per second before scrutiny
• 10DLC registered campaigns -- throughput tied to trust score (typically 3-75 MPS depending on brand vetting tier)
• Short codes -- highest throughput allowances (100+ MPS), but still monitored for anomalous spikes

Burst Detection

A sudden increase in message volume from a previously quiet number is a strong spam signal. Carriers track baseline sending patterns per number and flag deviations. A number that sends 5 messages per day and then sends 500 in an hour will almost certainly be filtered.

Snowshoe Detection

Snowshoe spamming distributes messages across many numbers to keep per-number volume low. Carriers detect this by correlating:

• Messages from numbers sharing the same CPaaS account or aggregator path
• Identical or near-identical message content sent from different source numbers within a short window
• Numbers provisioned in bulk around the same time with similar sending patterns

Modern carrier systems are specifically tuned to detect snowshoe patterns. Spreading volume across numbers without legitimate per-number traffic history increases rather than decreases filtering risk.

Sender Reputation

Every phone number used for sending accumulates a reputation score with each carrier. These scores are not visible to senders but directly influence filtering decisions.

Reputation Factors

• Number age -- newly provisioned numbers have no reputation and face a probationary period. Numbers with months or years of clean sending history receive favorable treatment.
• Complaint rate -- the ratio of spam reports to total messages sent. Even a fraction of a percent can trigger filtering if volume is high.
• Opt-out rate -- an unusually high rate of recipients replying STOP suggests the sender is messaging people who did not consent.
• Prior violations -- numbers previously flagged for spam, content violations, or carrier policy breaches carry persistent negative reputation.
• 10DLC registration status -- registered campaigns with verified brands receive significantly better treatment than unregistered traffic.

Number Recycling and Reputation Inheritance

When a phone number is released by one user and reassigned to another, the new holder may inherit the previous number's reputation -- good or bad. A number that was previously flagged for spam can arrive with pre-existing carrier blocks. There is no reliable way to check a number's reputation history before acquiring it, though some CPaaS platforms attempt to screen numbers before provisioning.

Carrier-Specific Filtering Systems

Each major US carrier operates its own filtering infrastructure with distinct characteristics.

AT&T

AT&T is widely regarded as the most aggressive carrier for SMS filtering. Key characteristics:

• Netnumber / TrueContact integration -- AT&T relies heavily on Netnumber's Entity Identity Management (EIM) platform and TrueContact database for sender verification and reputation scoring.
• Content filtering emphasis -- AT&T's systems place significant weight on message content analysis, making it the carrier most likely to filter based on keywords and URLs alone.
• 30-day blocking -- when AT&T blocks a number, the block typically persists for 30 days and cannot be appealed in most cases.
• Strict 10DLC enforcement -- unregistered A2P traffic on local numbers faces the highest filtering rates on AT&T's network.

T-Mobile

T-Mobile combines content analysis with reputation scoring and is notable for explicit financial penalties:

• Content and reputation scoring -- T-Mobile uses a dual-factor system that weighs both message content and sender reputation history. A clean sender with slightly risky content may pass; a low-reputation sender with clean content may still be filtered.
• $10,000 per-violation fines -- T-Mobile's messaging policies include financial penalties of up to $10,000 per violation for non-compliant messaging, enforced through CPaaS partners.
• Campaign-level enforcement -- T-Mobile ties filtering decisions to 10DLC campaign registrations, meaning a violation on one number in a campaign can affect all numbers in that campaign.
• Sprint network integration -- since the T-Mobile/Sprint merger, filtering policies cover both networks, though legacy Sprint numbers may behave differently during ongoing integration.

Verizon

Verizon has historically applied less aggressive filtering than AT&T or T-Mobile, but enforcement has tightened significantly since 2023:

• Increased filtering since 2023 -- Verizon expanded its filtering capabilities in response to FCC pressure and rising consumer complaints, closing the gap with AT&T and T-Mobile.
• Reputation-weighted -- Verizon's system leans more heavily on sender reputation than pure content analysis, making number age and sending history particularly important on this network.
• Slower block resolution -- when Verizon does block a number, resolution through support channels tends to take longer than with other carriers.

Complaint-Based Blocking

Consumer complaints are one of the most powerful inputs to carrier filtering decisions.

STOP Keyword Processing

All A2P messaging is required to honor STOP replies. Carriers monitor STOP rates per sender number:

• A STOP rate above 2-3% is a strong negative signal
• Continuing to send to a number after it has replied STOP is a serious violation that can result in immediate blocking of the sender
• Carriers track STOP compliance independently of the CPaaS platform's opt-out management

7726 (SPAM) Reporting

Consumers can forward suspected spam messages to 7726 (which spells SPAM on a phone keypad). These reports feed directly into carrier filtering systems:

• Reports are aggregated per sender number and per message content pattern
• A threshold of reports (which varies by carrier and is not published) triggers automatic investigation and potential blocking
• 7726 reports carry more weight than STOP replies because they indicate the recipient considers the message unwanted rather than simply unsubscribing

Machine Learning and AI Classifiers

Carriers increasingly supplement rule-based filtering with machine learning models.

Training and Approach

ML models are trained on labeled datasets of known spam and legitimate messages, incorporating features such as:

• Message content embeddings (semantic meaning, not just keywords)
• Sending pattern features (time of day, volume, recipient diversity)
• Sender metadata (number age, type, registration status, geographic patterns)
• Network-level signals (originating aggregator, interconnect path)

These models can detect novel spam campaigns that rule-based systems miss, because they recognize behavioral patterns rather than specific content. Carriers retrain models regularly as spammer tactics evolve.

Adaptive Thresholds

ML systems allow carriers to adjust filtering sensitivity dynamically. During periods of elevated spam activity (such as election seasons or tax filing deadlines), carriers can lower the threshold for blocking, which increases false positives for legitimate senders.

The Role of Industry Databases

Several centralized databases and registries support carrier filtering decisions.

iconectiv

iconectiv operates the Toll-Free Number Registry and provides number assignment data used by carriers to verify sender identity. It also supports the Secure Telephone Identity (STI) framework for STIR/SHAKEN caller authentication.

NetNumber

NetNumber's TITAN platform provides real-time entity identification for phone numbers. Carriers query NetNumber to determine:

• The entity behind a sending number
• Whether the number is registered for A2P messaging
• Historical reputation data aggregated across carriers

The Campaign Registry (TCR)

For 10DLC traffic, The Campaign Registry serves as the central authority. Carriers query TCR to verify that a sending number is associated with a registered brand and campaign. Unregistered traffic is subject to significantly higher filtering rates and lower throughput caps.

Monitoring for Filtering

Detecting that messages are being filtered is difficult because carriers do not send explicit rejection notifications in most cases. Messages are silently dropped.

Detection Methods

• Test messages -- send messages to real devices on each carrier network and verify receipt. Maintain test numbers on AT&T, T-Mobile, and Verizon.
• Delivery receipt analysis -- monitor delivery receipt (DLR) rates per carrier. A sudden drop in delivery rate on one carrier while others remain stable strongly suggests carrier-level filtering.
• Engagement tracking -- if messages contain URLs, monitor click-through rates per carrier. A drop to zero clicks from one carrier's subscribers indicates filtering.
• CPaaS analytics -- platforms like Twilio and Bandwidth provide per-carrier delivery metrics and error codes. Error code 30007 (carrier violation) and 30034 (messaging blocked) on Twilio indicate carrier filtering.
• Carrier lookup tools -- some services offer number reputation lookups, though accuracy varies and results may lag behind actual carrier state.

Response to Filtering

When filtering is detected:

1. Stop sending from the affected number immediately to prevent further reputation damage
2. Review recent message content for potential trigger patterns
3. Check opt-out and complaint rates for anomalies
4. If using 10DLC, verify campaign registration is active and in good standing
5. Contact the CPaaS provider for carrier-specific error details
6. Allow a cooling-off period (typically 7-30 days) before resuming sending from the number

Silent drops are the norm, not the exception. Building monitoring into any messaging system from the start is significantly easier than diagnosing delivery problems after the fact.

Further Reading

• SMS Deliverability -- maximizing delivery rates, avoiding filters, and monitoring sender reputation
• What Is 10DLC? -- the Campaign Registry, brand and campaign registration, trust scores, and throughput limits