Chapter 21 — Carrier Billing & Embedded Telco Payments

Amir is 18, a polytechnic student in Singapore, and he's about to make a terrible tactical decision. His guild is 20 minutes from a raid boss, and he needs 500 GemCoins — $4.98 worth of in-app currency — to unlock a limited-edition weapon skin before the fight starts. Problem: Amir doesn't have a bank account. He doesn't have a credit card. What he does have is a prepaid Singtel plan with $22 of airtime sitting on it.

At checkout in the GamerKaki app, he taps "Pay with Phone Bill," types in his mobile number, receives a one-time password via SMS, punches it in, and sees "Payment successful. $4.98 deducted from airtime." Three taps. Four seconds. No bank required.

But here's the thing: that $4.98 didn't touch a card network. It didn't pass through an issuing bank or an acquiring bank. It flowed through Singtel's billing system — a completely separate payment rail with its own economics, its own fraud patterns, and its own regulatory quirks. And GamerKaki, the game studio? They'll only see about $3.49 of that $4.98, after the operator and aggregator take their cut.

Welcome to carrier billing — the payment method that turns every SIM card into a wallet.

What Is Carrier Billing?

Carrier billing (also called direct carrier billing or DCB) is a payment method where a purchase is charged to a customer's mobile phone bill — either deducted from prepaid airtime or added as a line item on a postpaid bill. The customer's mobile operator acts as the billing infrastructure, replacing the card network, the issuing bank, and the acquiring bank in a single relationship.

The concept isn't new. If you're old enough to remember downloading ringtones by texting a shortcode — that was carrier billing's earliest incarnation. Premium SMS (PSMS) let you buy content by sending an SMS to a five-digit number, with the charge appearing on your phone bill. It was wildly popular in the early 2000s, generating billions in revenue for operators and content providers alike.

Then came WAP billing — one-click purchases on mobile web pages that charged directly to your line. And eventually, the modern standard: direct carrier billing, where an online checkout flow authenticates you via OTP and charges your operator account through a structured API.

The terminology can be confusing, so here's a quick decoder:

Why does carrier billing still exist in a world of tap-to-pay cards and instant e-wallets? One word: reach. Anyone with a SIM card — prepaid or postpaid — is a potential customer. No bank account needed. No credit check. No onboarding form. In Southeast Asia, where 30% of young consumers lack a payment card, that reach translates directly into conversion. For GamerKaki's player base, offering carrier billing isn't a nice-to-have — it's the difference between monetizing a third of their audience and losing them at checkout.

But carrier billing carries baggage. In the United States, the early 2000s saw a wave of "cramming" — unauthorized third-party charges appearing on phone bills. The FTC's $105 million settlement with AT&T alone (comprising $80 million from the FTC, $20 million from state attorneys general, and $5 million from the FCC) resulted in $88 million being distributed to 2.7 million affected customers. That enforcement legacy shaped today's strict consent requirements and fundamentally limited carrier billing's growth in North America.

How the Money Moves: End-to-End

Let's trace Amir's $4.98 GemCoin purchase from tap to settlement — every party, every handoff, every take.

Here's the step-by-step:

1. Amir selects carrier billing at checkout and enters his mobile number (technically, his MSISDN — the international format of his phone number).
2. GamerKaki's backend calls the DCB aggregator's API (in this case, Boku) with the order details: amount, currency, and Amir's phone number.
3. The aggregator routes the request to Singtel's operator API. This is where having an aggregator pays off — GamerKaki integrated once with Boku, and Boku maintains the technical connections to hundreds of operators globally.
4. Singtel checks Amir's line: Is it active? Is it prepaid or postpaid? Does the prepaid balance cover $4.98? Has Amir hit any operator-imposed spend limits?
5. Singtel sends an OTP to Amir's phone via SMS. This is the consent mechanism — the equivalent of entering your PIN at a card terminal, but over SMS.
6. Amir enters the OTP in the GamerKaki app, which forwards it through the aggregator to Singtel.
7. Singtel validates the OTP and deducts $4.98 from Amir's prepaid balance. For postpaid customers, this would appear as a line item on next month's bill instead.
8. A webhook fires back through the chain: operator to aggregator to GamerKaki. The app unlocks Amir's GemCoins.
9. Settlement happens later — much later. Singtel pays the aggregator on a monthly billing cycle, net of the operator's revenue share. The aggregator then pays GamerKaki, net of its own fee, typically on Net 30-60 terms.

Here's what's remarkable about this flow: no card network, no issuing bank, no acquiring bank, no interchange, no 3DS. The operator is the entire billing infrastructure. That simplicity is carrier billing's superpower — and its limitation, because it also means no card-network dispute protections, no chargeback rights, and no standardized cross-operator reconciliation.

Integration Models: Four Ways In

If GamerKaki decides to add carrier billing, they have four integration patterns to choose from, each trading off control against convenience:

Direct operator integration means building a bespoke connection to each operator's API. Singtel's API looks different from StarHub's, which looks different from M1's — and that's just Singapore. You get maximum control over the user experience and the deepest access to operator features, but the engineering effort scales linearly with every new market.

DCB aggregators like Boku, Bango, DIMOCO, and Infobip Centili solve the scaling problem. One contract, one API, one settlement — and the aggregator handles the technical and commercial relationships with hundreds of operators across dozens of markets. This is the most common pattern for merchants expanding beyond a single country.

Payment orchestration gateways offer DCB as one alternative payment method alongside cards, wallets, and bank transfers. If GamerKaki already uses a payment gateway like Adyen or Checkout.com, they may be able to enable carrier billing as an additional method without a separate integration. The tradeoff: less customization of the DCB-specific checkout flow.

SDK-based in-app integration uses lightweight mobile libraries provided by aggregators or operators. These are optimized for mobile-native apps (exactly GamerKaki's use case) and can handle the OTP flow natively within the app, without redirecting to a browser.

For GamerKaki, the choice is fairly clear: a DCB aggregator or in-app SDK gives them multi-operator coverage across Southeast Asia without building and maintaining dozens of direct integrations.

Commercial Model: Who Gets Paid What

Here's where carrier billing gets uncomfortable for merchants used to card economics. When Amir pays $4.98 for GemCoins, here's roughly how the money splits:

• Singtel (operator) keeps 15-40% — let's say 25% in this scenario, or $1.25. The operator earns this for providing the billing infrastructure, bearing collection risk on postpaid accounts, and handling customer service.
• Boku (aggregator) takes 5-15% — say 5%, or $0.25. This covers their API infrastructure, operator relationship management, settlement handling, and fraud tools.
• GamerKaki (merchant) receives the remainder: $3.49, or about 70% of the face value.

Compare that to card economics, where GamerKaki would keep roughly 97-98% of the $4.98 after interchange and processing fees. The math looks brutal — until you consider that 30% of GamerKaki's audience can't pay with a card at all. A $3.49 net payment from Amir is infinitely better than a $0 lost sale.

The commercial logic works best for high-margin digital goods (games, streaming, content subscriptions) where the marginal cost of delivery is near zero. A $4.98 GemCoin that costs GamerKaki essentially nothing to produce still generates $3.49 in contribution margin through carrier billing. For physical goods with real cost of goods sold, the 20-40% combined take rate usually doesn't pencil out.

Settlement timing adds another wrinkle. Card merchants are used to receiving funds within T+1 or T+2. Carrier billing settlement is tied to the operator's billing cycle — monthly for postpaid customers. The aggregator adds its own payment terms on top, typically Net 30-60. That means GamerKaki might wait 60-90 days to receive cash from Amir's purchase. If you're running carrier billing at volume, treat those receivables like telco receivables, not card settlement — and plan your cash flow accordingly.

Fraud, Disputes, and the Control Stack

Carrier billing's greatest strength — frictionless, no-card-needed access — is also its greatest vulnerability. Without card networks in the flow, there's no 3DS, no Address Verification Service, no chargeback process. The control stack has to be built differently.

The fraud typologies are specific to the rail. The most damaging is subscription fraud via malware — Android malware that silently subscribes users to premium services without their knowledge. The malware intercepts the OTP, completes the subscription flow, and the user only discovers the charges when their prepaid balance drains unexpectedly or their postpaid bill arrives with mysterious line items.

Other threats include OTP interception and social engineering (tricking users into sharing their one-time password), SIM swap attacks (where a fraudster takes control of the victim's phone number to receive OTPs), misleading UX and subscription traps (unclear recurring terms, hidden cancellation flows that keep charging customers long after they've lost interest), and bill shock on family plans (where a teenager's in-app purchases appear on a parent's postpaid bill).

Since 3DS doesn't apply — there's no card network to enforce it — the control stack relies on different mechanisms:

Strong consent capture is the foundation. Every transaction must record explicit evidence that the user understood the price, the merchant identity, and whether the charge is one-time or recurring. Operators and regulators increasingly require timestamp-and-evidence retention as proof of valid consent.

Spend limits and velocity rules cap exposure. In the EU, the PSD2 telecom exemption sets hard caps at 50 euros per transaction and 300 euros per month for digital content purchases via carrier billing. Singapore operators like M1 set similar limits: S$100 per transaction, S$300 per month.

SIM swap and number verification checks are becoming available through the GSMA's Open Gateway initiative and CAMARA APIs. These let merchants verify that a phone number hasn't been recently ported before completing a high-risk transaction.

Device fingerprinting and anomaly detection layer on behavioral signals — is this the same device Amir usually uses? Is the purchase pattern consistent with his history?

Subscription lifecycle management handles the ongoing risk: renewal reminders, easy one-tap cancellation, and dunning sequences for failed recurring charges. The objective isn't just preventing fraud losses — it's reducing refund volumes, regulatory exposure, and the risk of your aggregator or operator terminating your merchant account.

Regulation: Where Telecoms Meets Payments Law

Carrier billing sits at an awkward intersection of two regulatory regimes: telecoms regulation and payments regulation. The result varies dramatically by jurisdiction.

In the European Union, carrier billing operates under PSD2's telecom exemption (Article 3(l)), which allows operators to bill for digital content and services without being licensed as a payment institution — but only within strict limits: 50 euros per transaction, 300 euros cumulative per month. Anything beyond those thresholds requires a full payment services license. The PSD3/PSR framework (provisional political agreement reached November 2025, with final text expected Q2 2026) is expected to tighten fraud prevention and transparency requirements, though the exact scope of the telecom exemption in the final text remains unconfirmed.

In the United States, carrier billing is shaped more by enforcement history than by forward-looking regulation. The FTC's cramming crackdown — culminating in that $105 million AT&T settlement — established the principle that consumers must give informed, express consent before any third-party charge can appear on their phone bill. The FCC has since proposed streamlining legacy third-party billing rules as the broad market has contracted, but the consent standards remain the lasting regulatory artifact.

In the United Kingdom, premium rate services regulation has undergone a major transition. The Phone-paid Services Authority (PSA) transferred day-to-day regulatory responsibility to Ofcom on February 1, 2025. Under the new regime, maximum penalties increased from the PSA-era fines to 250,000 pounds per breach — a significant step up that signals Ofcom's intent to take enforcement seriously.

In Singapore and APAC, the regulatory approach is lighter-touch. Operators publish OTP safety guides and refund procedures for consumers. Merchant obligations span payments regulation, telecom consumer protection, and category-specific restrictions (gambling, adult content). All three major Singapore operators — Singtel, StarHub, and M1 — support carrier billing for Apple App Store and Google Play purchases, with operator-specific spend limits and eligible categories.

One often-overlooked regulatory question: who is the supplier of record for tax purposes? If the operator acts as a reseller (buying content from the merchant and reselling to the consumer), the operator handles VAT/GST. If the operator is merely a billing agent (collecting payment on the merchant's behalf), the merchant remains the supplier of record. This distinction affects invoicing, tax reporting, and cross-border compliance.

Market Size, Regional Map, and Key Players

Despite its niche reputation, carrier billing is not a small market — and it's growing. According to Juniper Research, end-user spend on carrier-billed services reached approximately $70 billion in 2023 and is projected to hit $122 billion by 2027. Operator revenue from carrier billing stood at $9.3 billion in 2024, with projections of $15 billion by 2029.

The regional picture varies significantly. APAC is the largest market by volume, driven by app-store billing in Japan (which accounts for a disproportionate share of global DCB spend), South Korea, and Southeast Asia. EMEA has the strongest regulatory framework and is where Open Gateway momentum is greatest — 73 operator groups have committed to the GSMA's Open Gateway initiative, though carrier billing represents only about 1% of live API deployments so far (most activity is in SIM swap detection and number verification). Latin America is a growth story driven by low card penetration, while North America remains constrained by the cramming legacy.

The merchant case study most frequently cited is the Orange/Boku partnership, which processed 12 million transactions totaling over 100 million euros in turnover across eight European countries — demonstrating that carrier billing can operate at scale even in heavily regulated markets.

Should You Use Carrier Billing? A Decision Framework

Not every merchant should add carrier billing. The economics are harsh, the settlement is slow, and the operational overhead of managing operator relationships, consent evidence, and cross-party refund workflows is real. But for the right use case, it unlocks an audience that no other payment method can reach.

Here are five questions to work through:

1. Is there a payment access gap? If your users have cards and wallets, carrier billing's high take rate rarely makes sense. It shines where 20-40% of your audience can't pay any other way.

2. Do your price points fit operator and regulatory limits? EU caps (50 euros/txn, 300 euros/month), operator-specific limits (M1 Singapore: S$100/txn, S$300/month), and category restrictions all constrain what you can sell.

3. Can your margin support a high take rate? Digital goods with near-zero marginal cost? Great. Physical goods with 30% gross margins? The math rarely works.

4. Can you run consent-first UX and customer care? Regulatory exposure and operator termination risk scale directly with ambiguous consent and poor cancellation flows.

5. Do you have operational maturity for reconciliation and refunds? Carrier billing settlement is monthly, cross-party, and lacks the standardized dispute infrastructure of card networks. You'll need entitlement matching, refund workflows across merchant-aggregator-operator, and tolerance for 60-90 day cash cycles.

For GamerKaki, the answers are clear: yes, yes, yes, yes, and "we'll build it." With 30% of their Southeast Asian players unable to pay by card, carrier billing isn't just another checkout option — it's the gateway to their largest underserved segment.

In the next chapter, we'll look at another payment method that repackages credit as a checkout experience — Buy Now, Pay Later. Where carrier billing leverages the telco relationship, BNPL leverages the lending relationship. The economics are different, but the fundamental question is the same: who bears the risk, and who pays for convenience?

Sources

• Juniper Research, "Carrier Billing: Market Forecasts, Key Opportunities & Vendor Analysis 2023-2027" — end-user spend projections ($70B 2023, $122B 2027) and operator revenue forecasts ($9.3B 2024, $15B 2029)
• FTC, "AT&T to Pay $80 Million to Consumers for Unauthorized Third-Party Charges" — total settlement $105M ($80M FTC + $20M states + $5M FCC), $88M distributed to 2.7M customers
• Boku/Orange partnership case study — 12M transactions, over 100M euros turnover across 8 European countries
• GSMA Open Gateway / CAMARA project — 73 operator groups committed; carrier billing approximately 1% of live API deployments as of early 2026
• PSD2 Article 3(l) telecom exemption — 50 euros/txn, 300 euros/month caps for digital content
• PSD3/PSR provisional political agreement, November 2025 — final text expected Q2 2026
• Ofcom, "Transfer of PSA Regulatory Functions," February 1, 2025 — maximum penalty increased to 250,000 pounds per breach
• M1 Singapore carrier billing terms — S$100/txn, S$300/month limits for app store DCB
• Singtel, StarHub, M1 — all three Singapore operators confirmed supporting Apple App Store and Google Play carrier billing