No simulated-phishing or security-testing programmes

The requirementstatement

Campaign content must not promote simulated phishing and security-awareness test messaging.

Severityseverity: BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: campaign.description + campaign.sample[] + campaign.message_flow
Where it liveslayer: Message contentMESSAGE_CONTENT
How Ekas settles itdetectability: AI · formAI_FORM; A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
What the fix involvesfailureClass: Hard stopHARD_STOP; Not remediable. Resubmitting will not help, and anyone offering to fix it is selling you a rejection.
Who requires itauthorities: TwilioT-Mobile
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

A simulated phishing text is indistinguishable from a real one to every system that handles it, so it trains carrier filters on the sender, generates the same consumer complaints, and reaches the same people — including employees who left months ago and whoever now holds a recycled number. T-Mobile fines it at Tier 1, the same band as actual phishing, which surprises security teams badly because the intent is defensive and the programme was signed off internally. Intent is not a defence the network can see.

How to fix itremediation

Move the simulation off SMS. Run the exercise on channels you control end to end — corporate email, an internal app, a managed device — where the deception never touches the public network. Where the awareness programme itself is worth texting about, register it on honest copy: reminders, enrolment and results, with nothing designed to be mistaken for something else.

Common mistakespitfalls

Internal authorisation and a signed engagement letter do not change the verdict: the carrier is assessing the traffic on its network, and the employer's consent is not the recipient's.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

Provider	Code	Resubmit
Twiliogen1	30884	No
Twilio	30007	Yes

Notesnotes

T-Mobile prices this at Severity-0 Tier 1, $2,000 per violation — the same band as real phishing, and assessed per message.

Rules you will hit next

6 other rules read campaign.description + campaign.sample[] + campaign.message_flow. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.

MSG-137No unsolicited bulk messagingBlockingBLOCKING MSG-161SHAFT screening covers every campaign field, not a sample of themBlockingBLOCKING MSG-164No underage, non-consensual or illegal sexual themesBlockingBLOCKING MSG-170No content promoting, glorifying or inciting violenceBlockingBLOCKING MSG-182No explosives, fireworks or pyrotechnics contentBlockingBLOCKING MSG-183No weapons that are not legal in all fifty statesBlockingBLOCKING

All message content rules

MSG-250 is one of 122 message content rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.