The short answer
- Separate passcodes from everything else: their own templates, their own sending rules and their own pricing.
- Treat alerts and reminders as service messages, triggered by the customer's account activity, and keep offers out of them.
- Protect the account as well as the app: country blocking, spending limits and fraud protection in Digital Connect, with request limits in your own app.
- Integrate from the systems you already run: REST from digital channels, SOAP from established core systems, SMPP for high-volume SMS.
The message map
| Message | Type | Usually triggered by | Watch out for |
|---|---|---|---|
| Passcodes for login, payments and device changes | Transactional | The customer's action in the app or online banking | Expiry, request limits, no promotion in the message |
| Transaction and account notifications | Transactional | Card, transfer or account events in your systems | Batch jobs can create sudden bursts; agree expected volumes in advance |
| Security alerts (new device, unusual activity) | Transactional | Your risk and authentication systems | Never ask for a code, PIN or password in the alert |
| Payment and loan reminders | Transactional | Due dates in your lending or billing system | Schedule ahead of the due date; amounts and dates must match the customer's record |
| Requests to update customer details | Transactional | Records due for update | Point to your official app or branch; do not ask customers to reply with personal data |
| Offers and product announcements | Promotional | Your marketing calendar | Only to customers who opted in; opt-out in every message; permitted hours |
Classification examples only. Your compliance team decides how each message is classified.
Keep passcodes apart from everything else
Passcodes are the messages customers notice when they fail: a code that arrives late means a login or a payment that does not happen. Treat them as their own product.
- Separate templates. A passcode message carries the code, a "do not share" line and nothing else. No offers, no links.
- Separate pricing. OTP traffic and marketing traffic are different products, so ask for them to be priced separately, not averaged into one rate.
- Arabic and English. An Arabic SMS holds 70 characters in a single message; English holds 160. Keep passcode templates short in both languages.
- Limit requests in your app: how many codes one number or device can request in a period protects both customers and your bill.
OTP SMS for secure customer verification
Protecting the account against SMS fraud
Login and sign-up screens that send passcodes on request are a common target for SMS pumping: bots request codes to numbers that earn the attacker a share of the delivery revenue, and the sender pays for every message. Digital Connect includes fraud protection, country blocking and spending limits on your account, and a delivery receipt for each message, so you can see where every message went. Keep request limits and human checks in your own app as well.
OTP fraud and SMS pumping: signs and controls
Alerts customers can trust
Bank alerts have to be recognisable as genuine, every time:
- Send from your registered sender name, every time. Sender names in Saudi Arabia are registered with the regulator and the operators; Interkey handles this during onboarding.
- Use approved templates, approved by your team and by Interkey, so every alert of the same kind looks the same.
- Never ask for a passcode, PIN or password in any message, and say so in your passcode templates.
- Point to your official app or branch in security alerts and detail-update requests, instead of asking the customer to reply with information.
- Respect the customer's language: send Arabic or English templates according to the preference in the customer's record.
Integrating with core and digital channels
Banks rarely send all messages from one system. Digital Connect offers three interfaces, so each system can use the one it handles most easily:
| System | Interface to consider | Why |
|---|---|---|
| Mobile app and online banking back ends | REST | Works from almost any language |
| Core, card or lending systems that already call SOAP services | SOAP | Avoids building a new REST client into an established system |
| High-volume SMS platforms | SMPP | A persistent session for sustained high-volume SMS |
Your systems connect from whitelisted IP addresses or over a VPN connection, and platform users sign in with two-factor authentication, using a verification code sent by email, at admin or user permission level.
How SOAP, REST and SMPP fit enterprise systems
Security and access controls in Digital Connect
How Digital Connect fits
- Passcodes, alerts, reminders and campaigns as SMS from one platform, through the API or the web platform.
- Fraud protection, country blocking and spending limits on your account.
- A delivery receipt for each message, and one set of delivery reporting.
- Approved templates and campaign scheduling in the platform for teams that send reminders and announcements.
- Sender name registration with the regulator and the operators, handled during onboarding.
- Support from Riyadh on the Saudi working week, in Arabic and English.
- Pricing is quoted for your volumes and message types, with passcodes priced separately from marketing traffic.
When it is not a good fit: if almost all of your customers are outside Saudi Arabia, or you send only a few hundred messages a month.
Company certifications: Interkey holds ISO/IEC 27001:2022 and ISO 9001:2015 certification, issued by AQC and valid until 12 February 2029. Each certificate states its scope; ask us for copies.
Questions banks and fintechs ask
Can we limit which countries our passcodes go to?
Yes. Country blocking limits your account to the countries you allow, and a spending limit caps what the account can spend. Ask us to set both during onboarding.
Are transaction alerts promotional messages?
An alert triggered by the customer's own account activity, with no offer in it, is generally a service message. Adding an offer to it changes that. Your compliance team makes the final classification.
Can our core system send messages over SOAP?
Yes, SOAP is offered where an existing business system requires it. Ask us which operations are available over SOAP for your account.
How is pricing set?
By quote, for your volumes and message types. Ask for passcode traffic to be priced separately from marketing traffic.
Who registers our sender name?
Interkey registers your SMS sender names with the regulator and the operators during onboarding.