# MSG-PHISHING — Content must not solicit credentials or sensitive data

> Messages must not ask recipients for passwords, full card numbers, SSNs, or account credentials.

- **Rule ID:** MSG-PHISHING
- **Layer:** Message content (`MESSAGE_CONTENT`)
- **Checks:** `campaign.sample[]`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Hard stop — not remediable, resubmission will not help
- **Required by:** CTIA, T-Mobile, Twilio, TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/message-content/msg-phishing/

## Why this rule exists

Credential solicitation over SMS is indistinguishable from smishing from the carrier’s side, and it is filtered and fined accordingly. Legitimate businesses do not need it — verification belongs behind an authenticated session, not in a text reply.

## How to fix it

Remove any request for credentials or full financial identifiers. Link to an authenticated page on your own domain instead of collecting data by reply.