In short
Look for commercial characteristics inside traffic declared as person-to-person: OTP or transactional content structure, high destination diversity, near-zero reply rates, machine-regular timing, repeated content templates, and volumes no subscriber could produce. Any one of these has innocent explanations; the combination does not.
What the disguise cannot hide
Commercial messaging has a shape that conversation does not. It goes to many destinations that never reply, it repeats a template with small substitutions, it arrives at machine-regular intervals, and it continues through the night.
A person sending from a handset produces the opposite profile on every one of those measures. That contrast is the basis of detection, and it holds even when the protocol-level evidence has been carefully sanitised.
The signals, ranked by usefulness
In practice these carry the most weight:
- Destination diversity — the ratio of unique destinations to total messages per source
- Reply ratio — genuine P2P is bidirectional; commercial traffic is almost never replied to
- Content similarity — near-identical structure across messages differing only in a code, name or amount
- Timing distribution — even spread across 24 hours rather than concentrated in waking hours
- Sender concentration — a small number of MSISDNs producing a disproportionate share of P2P volume
- Content markers — OTP formats, transaction references, brand names, shortened URLs
Separating bypass from legitimate exceptions
Some sources legitimately produce commercial-looking P2P traffic: machine-to-machine devices, dispatch systems, small businesses using ordinary SIMs for customer notifications. Blocking these damages real customers.
The distinguishing question is scale and intent. A local business notifying a few hundred customers is a candidate for an enterprise messaging product, not enforcement. An MSISDN range sending hundreds of thousands of OTPs for an international platform is bypass.
Confirming from the sending side
Network-side profiling tells the operator which of its own MSISDN ranges are behaving like termination infrastructure. Route testing tells it which supplier routes are responsible: a test message submitted with a registered alphanumeric Sender ID that arrives from a local mobile number confirms that the route terminated through a SIM rather than the agreed A2P channel.