What is RCS?
Rich Communication Services (RCS) is a messaging standard, developed under the mobile industry body GSMA, that upgrades the phone's built-in texting app beyond SMS. RCS chats support typing indicators, read receipts, group conversations, high-resolution photos and video, and messages from businesses that include logos, buttons and suggested replies. Android phones have used RCS through Google Messages for years, and Apple added support in iOS 18 in 2024, so RCS now reaches most smartphones. When either side can't use it, the conversation falls back to SMS or MMS.
Why RCS matters for security
RCS is a message-based threat vector. It delivers the same lures as SMS, in a richer and more convincing format. A fake delivery notice can arrive with a product photo, a clean layout and an official-looking link preview. People who have learned to distrust plain texts with odd links may relax when the message looks polished, and the phone screen still hides most of the clues a desktop would show.
Encryption varies by app. Google Messages encrypts RCS chats end to end between its own users, and the GSMA's Universal Profile 3.0 added a standard for end-to-end encryption between different apps, which vendors are still rolling out. Encryption protects a message in transit; it does nothing to stop a malicious link from reaching the person who reads it.
Verified senders and their limits
Businesses that use RCS Business Messaging go through a verification process and can display a verified badge, brand name and logo. That helps: a message claiming to be from a bank but sent from an ordinary mobile number, with no badge, is a warning sign. A badge is only one signal, though. Attackers still send lures from ordinary numbers, and verification processes are only as strong as the checks behind them, so the safe habit doesn't change.
An RCS lure
An employee's phone shows a chat from an unknown number with a high-resolution photo of a parcel: "Your package could not be delivered. Confirm your address within 24 hours." A link follows. The page it opens asks for a card number to pay a small redelivery fee. Every element is designed to look official, and none of it proves the sender is the courier. The right response is to ignore the link, open the courier's own app or type its address directly, and report the message as spam.
Defending against RCS threats
- Never act on an unexpected message through the link, button or phone number it provides; contact the organization through a channel you already know.
- Turn on spam protection in the messaging app, and report and block suspicious senders.
- Use mobile device management or mobile threat defense on managed phones to filter malicious links.
- Cover RCS, iMessage and messaging apps in awareness training, not only SMS.
RCS vs. SMS vs. iMessage
- SMS: plain text sent through the carrier, with no sender authentication and no end-to-end encryption.
- RCS: the GSMA successor to SMS, running over mobile data or Wi-Fi, with rich media and business messaging.
- iMessage and app-based messengers: proprietary services tied to one company's apps.
A phishing message on any of them is still smishing; RCS changes the delivery channel, not the attack.
RCS on the CompTIA Security+ exam
RCS is a newly added entry on the SY0-801 acronym list, and objective 2.3 names RCS among the message-based threat vectors alongside email, SMS, instant messaging and collaboration tools. A scenario about a rich text message with images or a branded sender that leads to a credential or payment page describes RCS as the vector and smishing as the attack. The controls are user awareness, independent verification and mobile device management. Distractors include vishing (a phone call), quishing (a QR code) and email phishing.