Go Back
On-demand

Monitoring Mobile: The Gotchas to Look for & How to get it Right

Insiders In-Focus: Practical answers to compliance challanges

If we believe every ad about monitoring mobile channels, it should be easy to solve and quick to deploy. So why is it still such a challenge? How should you approach this? Is channel banning enough? Shield’s Grant Ballew (Sales Manager) and David Aaronson (Sr. Product Marketing) discuss the gotchas to look out for and how to avoid them.

Speakers

Grant Ballew

Sales Manager, Shield

David Aaronson

Senior Product Marketing Manager, Shield

  • Transcript

    Monitoring Mobile: The Gotchas to Look For and How to Get It Right

    Shield Insiders In-Focus

    Speakers

    • Grant Ballew, Sales Manager, Shield
    • David Aaronson, Senior Product Marketing, Shield


    Introduction

    David: Hi, everyone. David Aaronson, Senior Product Marketing over here at Shield, here with Grant Ballew, Sales Manager at Shield. How are you doing today, Grant?

    Grant: Doing great, David. How about yourself?

    David: Oh, awesome. Okay. So we’re actually kicking off a really cool project here — this is our new Financial Compliance In-Focus. Because who wants to sit for a webinar for about an hour and thirty minutes? So we’re going to try to keep things snappy. We’re going to talk today about mobile communications and financial compliance.

    Grant: Hot topic.

    David: It’s always been a hot topic. It’s probably always going to be a hot topic. I mean, it’s been overtalked about at this point — the fines, what it means next — but somehow we’re still kind of in this question mode. We don’t necessarily see a whole bunch of people buying up all these solutions. There’s some weird stuff going on. So I’ve got a question for you, Grant. Why isn’t everyone solving this? Every vendor claims they can easily solve it, and it’s still not solved. What’s up with that?


    Why Mobile Compliance Still Isn’t Solved

    Grant: And I think you bring up a great point. This is a question that’s been going on for my twelve years in mobility and compliance. You really have to start with the big question: how do we message clients? That’s what we’re asking, that’s what the industry is asking, and we all want to solve it.

    But you have to take a step back and think about how the means by which we communicate — in business, both internally and externally — has greatly changed. Gone are the days when voice calls were the primary means. Then came email, which is obviously still relevant. But now it’s all about mobile messaging.

    I think about the estimated monthly numbers of 6 billion people using messengers, which includes iMessage, text message, Signal, WhatsApp, Telegram, and all the others. And then the fact that over 20% of that communication is business-related. This is a channel that’s not going away, and it has to get resolved. The next phase of that is the governance of all those channels, and it’s seemingly nowhere to be found — which leads to enormous disparities, and specifically two gaps: compliance and data ownership. That’s why many firms still forbid mobile messaging completely.


    Why Banning Mobile Isn’t the Answer

    Grant: But that isn’t the answer either, because frankly, mobile messaging is the preferred means of communication for a large portion of people. In fact, in a study done by Jennifer Aaker at Stanford Graduate School, they found there’s a significant increase in the likelihood of closing a particular deal if there’s a mobile messaging engagement with the economic buyer. So I understand the want, and really the need, of the sales force to use this channel of communication. When you look at it from a business perspective, there are numerous benefits and results — there’s value economically and from a productivity standpoint for every organization.

    I’ll put it in a personal spotlight. I hate to admit it, but my phone is next to me twenty-plus hours a day. It’s there when I wake up — it’s actually what wakes me up, with the alarm clock. When I’m on vacation, I still have my personal phone, which has my work email on it, so I’m always plugged in. Whether my wife and kids think that’s so great is another story, but you get my point: because I have my phone and mobility, I’m more productive.

    I say all this because I don’t believe the majority of messaging is intentionally used for malicious purposes. I think of it more from the sales perspective — that messaging provides significant opportunity, flexibility, and value. That said, there are bad actors and regulatory requirements we have to be aware of. And what we must solve are those two big gaps: data ownership and compliance.

    The Data Problem: Capture Creates New Challenges

    David: Yeah, that’s such an interesting insight. You’re saying this is a sales tool — I need this to sell. And we were just talking about this before the call, from the data side. Let’s say you didn’t have all these problems and somehow, magically, you solved all this. Then you’ve got even more problems, because now you’ve got all this new data pouring in, whatever the data structure coming in. First of all, you’re going to have to capture and archive it, and then you’ve actually got to surveil it. And now I’ve got all my false positives to deal with anyway. What’s this going to look like?

    We hear this a lot from our own customers: okay, what’s going to be on the other side? We need to be careful, because it’s a problem both ways — if you don’t capture it, and if you do capture it. So what’s the solution?

    Where to Start: Policy, Training, and Ownership

    Grant: That’s the proverbial million-dollar question.

    David: And $2.1 billion worth.

    Grant: Precisely. We’ve seen that so much lately. I think it starts with each individual organization clearly defining a policy around mobility — whether you want to employ a corporate-issued rollout or a BYOD strategy, there has to be a strong plan and policy in place. And then you take it one step further and ask: what’s the training on these policies and procedures?

    We work with financial institutions around the world, and they have to adhere to some of the most stringent regulations of any industry. They have experienced IT teams. They know the risk and the need for compliance. But because of the beneficial economic factors I mentioned earlier, there’s some kind of unspoken influence on how to manage it. I wouldn’t say a blind eye is turned to it, per se. But because of the complexity of messaging, every organization is searching for this perfect solution — and I don’t think it’s out there.

    David: And the fact is, that avalanche of data we keep talking about — no matter which way you look at this, we have to solve it. I think we’ve got to the point in the conversation now where we do what I like to call our “five and five.” We’re going to ask five questions, and we’re going to pretend I have a clock, and try to get about one minute on each one.

    What Is the Solution?

    Grant: Before we do that, let me answer your question directly: what is the solution? The blanket no-texting policy is not going to work. Employees are going to circumvent the policy — that may simply be not knowing, or carelessness, or, as I mentioned, bad actors. But I don’t believe most of the messaging is malicious, and I think most employees would be fine with capturing and storing business conversations. That’s where data ownership comes into play. The issue becomes when the compliance requirements become too much of a burden to make the communication channel valuable.

    Four Ways to Capture Mobile Messaging

    Grant: There are a number of solutions that provide some form of capturing these messaging channels. Four off the top of my head:

    • Network integrators, where they get a copy of your messages and calls directly from the operator network side — which excludes iMessage.
    • Dual phone number options, where there’s a business number on a single device and all business communication is captured. You get pushback from the field, obviously, because they want to use the same number they’ve had for the relationship with their customers and clients.
    • Bots that can be added into these native messaging apps as a third member to capture the information, which is a little cumbersome.
    • Consumer and official versions of the same app on devices, which requires the user to use the appropriate app at the appropriate time.

    So no matter what solution is deployed, the important question that arises is: what do we do with all this data? Are we partnered with the right archiving, surveillance, and supervision vendor that can ingest and then intelligently alert on these communications? The last thing risk management and compliance want, as you know, is more false-positive alerts. And then there’s being able to have a holistic approach — organizing the conversation timelines and looking at multiple channels, since there’s inevitably channel-hopping, for eDiscovery purposes.

    So I’ll leave you at this, and we’ll jump into the five and five. I really wish there was some easy nirvana approach to it — here’s the solution, we’re good to go — but it’s just not the case. With the right policies, procedures, and ultimately training, you can make an effective solution for your organization.

    David: Aren’t you just a ray of sunshine today? I mean, we do have some solutions, right? There are ways to do this.

    Grant: Yep. There’s a little bit of how, and which way to do it, and there are pros and cons. And like you said, we also need to really keep an eye down the road — what happens if we actually do this? What’s going to happen to all of our compliance teams?

    The Five and Five

    David: Okay, long-term picture. All right, let’s do the five and five. Question one: Have we banned mobile out of existence?

    Grant: No. Mobile messaging is here to stay, and it’s only growing. So get a plan in place. As I said, the no-texting policy is not going to work. It’s a preferred channel of communication, and it’s only going to grow moving forward.

    David: Sales tool. We need our sales tools. Okay, so policies didn’t work for banning — do they still have a place?

    Grant: One hundred percent. And that really starts with creating an internal focus team that brings in stakeholders from every role to say: what does the landscape look like, what do we need to do, what’s going to be best for our organization? Then clearly define it so it’s digestible, and reinforce it on a consistent basis at all levels of the organization. That’s the first layer — user compliance. You can have all the policies in place, but if your teams aren’t aware of them, it’s really not doing a whole lot.

    David: Everyone and their grandmother has announced they have a solution, and there’ll be another one tomorrow, I’m sure. So you’ve told us the pros and cons of each one — so what do you do?

    Grant: Once you’ve identified internally, through these stakeholder conversations, what the best plan is, you have to partner with the right vendor. I mentioned the four routes you can go earlier. But ensure that the vendor you ultimately select meets the checklist you’ve clearly laid out in a mobility assessment — that it’s checking all those boxes. And then, what is that vendor’s outlook going forward? Are they innovative? Do they have a unique approach to solving some of these problems? Are they going to listen to your feedback as an organization about what your pain points are, and work together to find those solutions?

    David: So what other factors should we be looking at?

    Grant: Usability — the UX and UI of any of those systems. The user experience has to be simplified and usable, not putting additional hurdles in the communication channel. And the governance of it: what’s our long-term strategy? What if the API shifts? The product roadmap, and things along those lines, as far as innovation and understanding all of that.

    David: Okay. The ultimate question: is there a gotcha that people need to look out for?

    Grant: Well — how much of a mess do you want to clean up after you ingest all this data? That gotcha is: once we get all this data, we have our plan in place, we know mobile messaging is here to stay, we’ve got a plan and a policy, we’ve selected our vendor, we’re looking at the long-term perspective — how are we ensuring that once we have this data, it’s in a digestible format we can use for surveillance, eDiscovery, and supervision? What’s coming out the other end is what you really have to look at, once you’ve gone down this pecking order of what we need to accomplish from a mobility landscape.

    Closing

    David: Amazing. Thank you, Grant. This was an awesome conversation. Let’s keep the conversation going.

    Grant: Yeah, let’s keep this going. Hit up our website, let’s have a chat. There’s a lot to discuss — we’re here to help.

    David: This is Shield Financial Compliance In-Focus. You didn’t spend an hour thirty, and you got a lot out of it. I think this is the way of the future. Am I right, Grant?

    Grant: That’s right. Absolutely, a hundred percent. Thanks for spending some time, David.

    David: Amazing. And thank you for watching.

Q&A

Why can’t we just ban texting and messaging apps?

Because banning backfires. Employees circumvent no-texting policies out of carelessness or genuine need, and mobile is now the preferred business channel. Around 6 billion people use messaging apps monthly, and more than 20% of that traffic is business-related. Stanford research even found that messaging the economic buyer raises the likelihood of closing a deal, so a blanket ban only pushes conversations into blind spots you can’t see or defend.

If every vendor says they can solve mobile compliance, why isn’t it solved?

Because the hard part isn’t capture— it’s governance and data ownership. Communication moved from voice to email to mobile messaging faster than oversight could follow, leaving two persistent gaps: compliance and ownership of the record. With off-channel fines already cited at roughly $2.1 billion, plenty of vendors promise easy fixes, but few address what actually happens to the data once it’s captured.

Do we really need to capture mobile messages, or can we look the other way?

You have to capture. Regulators expect it, and the penalties prove it — off-channel communication fines have reached around $2.1 billion. Mobile isn’t going away: of the roughly 6 billion people on messaging apps, more than 20% use them for business. Ignoring the channel creates compliance and data-ownership gaps that surface at the worst possible moment— during a regulatory request or investigation.

What are our real options for capturing WhatsApp, iMessage, and texts?

There are four main approaches, each with trade-offs. Network integrators copy messages and calls from the carrier, but that excludes iMessage. Dual-number solutions put a business number on one device, though salespeople resist changing numbers. Bots join native apps as a third participant, which feels cumbersome. And paired consumer-and-official app versions require users to pick the right app every time. Coverage and user experience vary widely across them.

How should compliance teams evaluate a mobile capture vendor?

Build a mobility assessment checklist and confirm the vendor meets it. Prioritize simple UX that doesn’t add friction to the channel, a clear roadmap for when messaging APIs change, and a vendor that acts on your feedback. Ask how the captured data is governed over the long term.

What happens to all the data once mobile messages are captured?

Capture is only the start. The data arrives in high volumes and varied formats, so it has to land in an archive and flow into surveillance and supervision that can alert intelligently — without burying teams in false positives or losing conversation timelines when people channel-hop.

What’s the biggest “gotcha” in mobile compliance?

The mess you have to clean up after ingestion. If captured data doesn’t come out in a usable, structured format, you can’t run effective surveillance, supervision, or eDiscovery. Plan for what comes out the other end, not just what goes in.

Subscribe to our newsletter

Gain access to exclusive insights, industry influencers, and thought leaders in

Digital Communications Governance and Archiving (DCGA).