Experts agree: data security is the cornerstone of a thriving business. When you’re texting with customers or other contacts, keeping their SMS data secure is crucial to their trust in your brand.
But business texting was invented fairly recently, gaining popularity around 2010. Not everyone is aware of best practices for messaging safely. Even if you’re already using a secure text messaging platform, it’s important to take advantage of the tools at your disposal.
Use these seven tips to keep customer conversations secure.
Tip #1: Ensure the right people text your customers
Cybercriminals target usernames and passwords, making it important for your team to have an extra layer of security when they log into their text messaging platform. So first and foremost, you need to restrict platform access.
To ensure only permissioned people can access your platform, you’ll want to:
- Require two-factor authentication (2FA), which asks your team members for two identity verification methods, like entering an email address and password then an SMS code
- Adopt SAML SSO (single sign on), which lets platform users confirm identities with one identity provider (IdP), like Meta, to log into your texting platform
- Take full advantage of your platform’s deactivation tools, removing mobile and web accounts immediately after an employee’s departure
You’ll also want to ensure the right team members are accessing specific data with your platform’s team administration tools, like roles and permissions. Assign roles to provide each team member with a specific set of permissions, which are access and control capabilities. Some platforms even offer custom user roles and permissions, which allow you to create unique roles with hand-picked permissions, from report access to restricted view of personally identifiable information (PII).
Tip #2: Know which SMS compliance measures apply
Depending on your brand’s location and industry, you will be subject to certain SMS standards and regulations. These standards aim to protect your customers’ or patients’ data and well-being. They may include the TCPA and HIPAA, among others.
On a regular basis, your team should:
- Review which SMS compliance measures apply to your brand
- Examine the processes by which your brand is adhering to the measures
- Adjust or make changes to any processes you find lacking
You should also ensure your SMS platform is SOC 2 Type 2-compliant and HIPAA compliant, giving you a leg up on complete compliance achievement. While compliance with these measures doesn’t guarantee SMS security, it usually helps you put processes in place to stay secure.
Tip #3: Ensure customers have opted in before texting them
It’s critical to get written permission from customers before you text them. (It’s often a requirement of the above standards, like the TCPA.) They can either text in a keyword or check a box on a web form to opt in. You don’t want to text people who don’t want to hear from you; that can be perceived as a breach of their personal privacy.
To ensure customers are willing to text with you, be sure to:
- Confirm that new contacts know they’ve signed up for your SMS services
- Reintroduce yourself with your company’s name when you message established customers
- Provide opt-out information on each initial text you send in conversations
Today’s business text messaging platforms often offer opt-in management features, simplifying the process of capturing SMS opt-ins, gathering opt-ins through online forms, and generating opt-in reports. These tools make it easier to ensure each contact is providing the appropriate consent.
Tip #4: Stick to sharing administrative information
Business SMS platforms offer a certain amount of security from the get-go. A secure platform will use SSL, an encryption-based Internet security protocol, to encrypt texts between you and your customers. Encryption scrambles the data so people without the decryption key can’t read it.
But once texts reach someone’s phone, there’s room for problems. For example, a friend might grab your contact’s phone or a stranger might open their messaging app on a public desktop. Because of these potential situations, you need to stick to only sharing administrative information through SMS.
You can send customers:
- Appointment scheduling information or reminders
- Order confirmations
- Delivery updates
- Product tips
- Opinion polls
- Operational announcements
Do not send any sensitive information. This can include patient information, like test results or diagnoses, or financial information, like earning reports. If you need to share sensitive information, you can text customers a link to your business’s secure portal.
Tip #5: Use secure tools for payments
Conversational marketing is becoming more popular. It’s a strategy where sales teams engage in authentic, person-to-person messaging conversations about products or services. Customers will sometimes decide they want to buy something during these chats, and some messaging platforms even allow for in-app transactions.
Use secure tools for in-messaging payments, such as:
- Apple Pay
- Google Pay
Apple Pay and Google Pay are included in-app with Apple Business Chat and Google’s Business Messages respectively. If you’re messaging customers through business SMS, Facebook Messenger, or WhatsApp, you’ll need to direct them to a link for payment.
Tip #6: Escalate texts that become gray areas
Secure text messaging isn’t always black and white. If you encounter a situation that seems like it may end up compromising your customers’ or your business’s security, escalate to an email or a phone call.
For example, you may want to switch channels if:
- Customers are confused about whether or not they’ve opted in to your SMS services (i.e., if they seem confused about why you’re texting them)
- Customers begin asking follow-up questions about sensitive information (i.e., they want to know what their test results are without logging into their secure portal)
- Customers want to send their credit card numbers over the messaging system
In any case where customers seem on the brink of endangering your secure text messaging system, ask them to switch channels so you can provide secure service.
Tip #7: Review texts for SMS security
Your business SMS platform should offer configurable data retention options so you can choose whether and when to delete contacts, conversations, and message data. Save texts long enough to conduct reviews for quality control, training, and compliance.
When you review text messages, ensure that:
- Initial opt ins are confirmed with a follow-up text
- Opt-out instructions are readily available at the beginning of SMS conversations
- No sensitive information (test results, diagnoses, financial information, credit card numbers) is shared
- All “gray area” conversations are escalated to another channel
After you review your texts, you can make improvements in any identified problem areas. Regularly reviewing texts and making subsequent changes is a surefire way to achieve secure text messaging.
Want to learn more about secure text messaging? Download our SMS Security and Compliance Guide.
