Encrypted messaging continues to evolve as mobile platforms experiment with new standards and interoperability. Recent developments hint at meaningful changes in how users communicate across devices and networks, raising questions around implementation, timing, and broader industry implications while leaving many details still to unfold. MEF Principal Analyst for Business Messaging Pamela Clark-Dickson takes a look at what could come next.
It appears that end-to-end encryption is finally in sight for Apple’s implementation of RCS on the iPhone, with the news that Apple is enabling testing of RCS E2EE in the beta of iOS 26.4.
*Note: GSMA specification
Apple’s beta testing of E2EE signals the impending advent of global, cross-platform, encrypted messaging which is available natively on iPhone and Android devices, and which rivals WhatsApp in terms of global reach.”
Another potential drawback, according to several reports, is that – in beta testing at least – iPhone users need to turn off iMessage to enable encrypted chats on RCS. This is due to Apple’s existing messaging hierarchy, where RCS is typically only activated as the fallback communications channel when iMessage cannot deliver a message (as would be the case when messaging an Android user), or is switched off. Switching iMessage off guarantees the RCS activation required to test E2EE.
This limitation of the beta testing is unlikely to persist into the final public release, that is, Apple will want to avoid iPhone users having to manually switch between iMessage and RCS if they want to access encrypted RCS chats. It’s more likely that the vendor will build RCS E2EE into the messaging fallback process.
However, RCS E2EE will not ship as a feature in iOS 26.4, meaning end-users will have to wait until beta testing is completed – and a future iOS 26 update – to get their hands on it.
Also, the capability is available for testing on a limited number of devices and telcos; and RCS itself is supported on iOS in only 16 countries: US, Canada, Brazil, Belgium, France, Germany, Greece, Spain, UK, Czechia, Slovakia, China, India, Japan, Singapore, South Korea.
It’s taken some time for Apple to get to this point. When it first announced its support for RCS on iOS in November 2023, it referenced the lack of strong encryption in the RCS specifications, stating that it would work with the GSMA to boost protections.
Apple’s efforts have clearly proven fruitful, with the GSMA adding Messaging Layer Security (MLS)-based E2EE to the RCS Universal Profile 3.0 specification, which was released almost 12 months ago. Both Apple and Google immediately pledged their support for RCS UP 3.0, but Apple has seemingly had the advantage of operating from a green-fields environment for deploying RCS UP 3.0 E2EE. Google will need to switch from its proprietary Signal-based E2EE to RCS UP 3.0 E2EE, which may take it a little longer; Google will likely run both systems in parallel for a time.
On the flip side, however, the implementation of E2EE in RCS may make it more difficult to identify and combat fraud and other malicious activities on the channel, since only the sender and the recipient can read/view the content of a message. Telcos have long been bound by legal intercept requirements for SMS, MMS, and voice services; E2EE typically makes it impossible for such intercept to occur, which has become a point of contention for governments and law enforcement agencies.
Meanwhile, platforms such as SMS firewalls can detect anomalies in traffic sending that suggest malicious attacks are occurring, enabling telcos, CPaaS providers and others to block bad actors. However, these types of platforms are at an earlier stage of development for RCS, mostly because the adoption and use of RCS is still nascent by comparison to SMS. Fortunately, in most countries, RCS doesn’t yet represent an attractive enough revenue opportunity for bad actors. But work is currently being done to find ways to prevent the exploitation of RCS, which centres around using stringent brand/campaign verification procedures; such work is vital to ensuring RCS is a trusted channel for consumers and the wider business messaging ecosystem.
