The Signal Brief Sample — Wilson Intelligence Services LLC

Today's signals08

Spoofing & Caller IDLATAMOfficial

Brazil decrees call authentication and 15-day blocks for abusive callers

Provisional Measure 1.396, dated 9 October and published in Brazil's official gazette on 13 October, requires the originating provider to authenticate each call, transit providers to preserve that authentication and the terminating provider to verify it before delivery, with unauthenticated calls blocked except where Anatel allows. Authenticated company calls must display the registered business name and logo drawn from a central numbering database that providers fund. Anatel has 60 days to issue the general rules and 30 days for the per-line limits; Congress must approve the measure within 60 days, extendable once, or it lapses.

Why it matters

Any carrier or aggregator terminating voice into Brazil, and any enterprise calling Brazilian customers, now has a sign-preserve-verify chain and a brand-identity registry to build against, on Anatel's clock rather than the 2028 date the government says this replaces.

Do this

Ask your Brazilian termination partners which authentication scheme they expect Anatel to adopt, and start collecting the business name, CNPJ and logo data your outbound numbers will need in the central database.

OCT 13Planalto, MP 1.396/2026 ↗Canaltech ↗

A2P & CPaaSAPACVendor claim

Silent carrier checks start displacing SMS passcodes in India's UPI

NPCI circular OC-238, issued on 30 September 2026, recognises Silent Network Authentication as an alternate device-binding method for UPI while requiring SMS binding to remain available as a fallback. Fraud platform Bureau says its implementation now handles more than three million device-binding and re-authentication events a day, with integrations at Reliance Jio, Bharti Airtel and Vodafone Idea. The volume, coverage and conversion figures are Bureau's own and Tech Times did not verify them; the article also notes the method cannot detect a recent SIM swap or port and fails on Wi-Fi-only sessions.

Why it matters

A regulator-sanctioned alternative to the OTP takes verification volume out of India's A2P flows and moves the fraud question to carrier-held SIM state, which is a signal most messaging teams do not currently buy or monitor.

Do this

Model the margin effect of a double-digit fall in verification SMS on your India routes, and ask any network-authentication supplier what SIM-swap recency the carrier API actually returns.

OCT 16Tech Times ↗

ScamsEUReporting

Cloned voice and a WhatsApp message moved 95 million euros

Biometric Update reported on 15 October, citing Reuters, that Fideuram, the private-banking arm of Intesa Sanpaolo, transferred about 95 million euros after its then chair received a WhatsApp message appearing to come from Intesa Sanpaolo's chief executive, followed by a call using an AI-cloned voice of a senior lawyer. The money went mainly to China and Hong Kong and roughly 53 million euros has been recovered. Milan prosecutors are investigating a foreign national living outside Europe on suspicion of computer fraud; no charges have been confirmed and the figures are approximate.

Why it matters

The attack arrived through consumer messaging and a voice call, so nothing in a bank's A2P or STIR/SHAKEN estate would have stopped it; the only effective control sat in payment authorisation.

Do this

Require a callback to a number already held on file, never the number that called, for any payment instruction that first arrives over a consumer messaging app.

OCT 15Biometric Update ↗

Cyber & BreachesAPACOfficial

Korean regulator probes breaches at 16 financial firms

South Korea's Financial Services Commission said on 14 October it is investigating hacking at 16 financial companies involving roughly 100,000 data-breach cases, including whether AI tooling was used, and has asked industry associations, regulators and affected executives to complete independent reviews across 12 areas. A Fitch analyst quoted in the same report expects the stolen data to resurface in smishing and email scams. Separately, the National Police Agency plans sequential warning texts to about 48 million subscribers of the three largest carriers from the third week of October.

Why it matters

Those warning texts will teach 48 million handsets to distrust unexpected financial messages in the same weeks leaked data starts feeding smishing, so legitimate bank and fintech traffic in Korea needs its sender identity to be unmistakable.

Do this

Confirm your Korean sender IDs, short codes and link domains are registered and consistent before the police alerts land, so your messages do not read like the scam they warn about.

OCT 14IDN Financials ↗SBS News ↗

SmishingAPACReporting

Manila SMS blaster seizure adds a third country this month

The National Bureau of Investigation arrested four people in Metro Manila, two Filipinos and two Chinese nationals, after stopping a rented car carrying an SMS blaster through crowded areas; a follow-on search of a Las Pinas apartment turned up the operators, further blaster components, drugs and a gun. The messages impersonated a bank and pointed to pages harvesting credentials for financial accounts. One driver told GMA News she worked ten hours a day for PHP2,000, about USD32, and was told only to find crowds. It follows blaster seizures in Jakarta and Cambodia this month.

Why it matters

Blaster traffic never crosses your network, so the first evidence a campaign ran against your customers is a cluster of failed logins and account-recovery attempts from one metro area, not anything in message logs.

Do this

Tell fraud and contact-centre teams covering Philippine customers to treat a localised spike in failed logins or recovery requests as a possible blaster campaign rather than ordinary credential stuffing.

OCT 16Commsrisk ↗

Voice & RobocallsUSReporting

Prerecorded-call claim survives without an autodialer finding

In Cruz v. United Collection Bureau, decided in the Southern District of California on 13 October 2026 and reported on 15 October, the court granted the collector summary judgment on the autodialer claim, finding no evidence that the LiveVox HCI system used a random or sequential number generator. It refused summary judgment on the prerecorded-call claim: the plaintiff's testimony that the calls sounded identical was enough to put that question to a jury, even though the defendant had records indicating no prerecorded calls were placed to the account.

Why it matters

Campaign-level records showing no recorded message may not end a claim, which matters most for teams rolling out synthetic or AI voice, where the TCPA exposure no longer depends on how the dialler selects numbers.

Do this

Check that your dialler keeps per-call evidence of whether a recorded or synthetic voice was played, rather than only the campaign configuration.

OCT 15TCPAWorld ↗

RegulationUSReporting

Texas court keeps a text claim alive under section 227(b)

A day after the Florida ruling that texts are not calls under the do-not-call rules, reporting on Taylor v. OffersPDQ shows the other half of the picture: the Southern District of Texas, on 1 October 2026, granted default judgment on a 227(b) text claim while denying the 227(c) claim, because that subsection needs two or more telephone calls in twelve months and the plaintiff had one message per claim. The court said a private right of action under 227(b) must stand unless the Supreme Court or the Fifth Circuit rules otherwise.

Why it matters

Exposure for messaging programmes is shifting from do-not-call theories to 227(b) consent defects, which live in your consent records and opt-in capture rather than in list scrubbing.

Do this

Pull a sample of SMS consent records and ask whether they would survive a 227(b) challenge, not only a do-not-call audit.

OCT 14TCPAWorld ↗

Identity & ATOGlobalVendor claim

Vendor report puts voice cloning in a fifth of deepfake cases

identifAI's first report, drawing on incident telemetry through August 2026, estimates deepfake-enabled scams produce about USD 40 billion a year in fraud and splits incidents into 42.7 percent video synthesis and 21.9 percent audio voice cloning, with the United States at 34.1 percent of cases, India 7.7 percent and the United Kingdom 6.6 percent. identifAI has not published the method behind the 40 billion dollar estimate, and SecurityBrief noted the company's own headline overstates the voice share by combining video and audio.

Why it matters

Even taken as an estimate, a one-in-five audio share is a reminder that voice is now a claim to be checked rather than an identity signal, which is a problem for contact centres still using voice recognition to authorise changes.

Do this

List every high-value action your contact centre allows on voice alone, and add a second factor to the top of that list.

OCT 14SecurityBrief Asia ↗

Brazil decrees call authentication and 15-day blocks for abusive callers

Silent carrier checks start displacing SMS passcodes in India's UPI

Cloned voice and a WhatsApp message moved 95 million euros

Korean regulator probes breaches at 16 financial firms

Manila SMS blaster seizure adds a third country this month

Prerecorded-call claim survives without an autodialer finding

Texas court keeps a text claim alive under section 227(b)

Vendor report puts voice cloning in a fifth of deepfake cases

What call authentication actually proves

Seeing a spike you can't explain?