Our test SMS went out under another client's brand: an unregistered sender ID is silently swapped by the provider

My client's first test SMS arrived signed with another client's name. The custom sender ID set in the organization's SMS settings was not registered with Brevo for France, so Brevo silently replaced it with another sender ID already approved on the same account, which happened to be another client's brand. Nothing in the platform flagged it: the test window still said "Sending from:" with the sender I had typed. Had I not tested on my own phone first, real customers would have received a review request signed by a different business, with no way to know who was really texting them. For a white-label agency, that is about the worst first impression possible.

What happens today (reproduced on a demo organization, 9 November 2026)

1. Platform → Messaging → SMS → our Brevo provider → Organizations → add the organization with the custom sender "DemoTest", never registered with Brevo. The form shows a warning ("Only use a sender you've already registered with your SMS provider") but accepts any value.

2. The "Test" button ("Tester") on that organization: the window says "Sending from: DemoTest".

3. The test SMS arrives under a different sender ID: another client's approved ID from the same Brevo account. Brevo's statistics confirm it was delivered with that other sender. No error, no warning in the platform.

4. On the real client account, two test SMS also left under other sender IDs. Once I registered the ID in Brevo (Settings → SMS sender IDs, per country) and it was approved, the next test and the real messages went out with the right sender.

Proposal

1. In the test window and the campaign's SMS settings, say plainly that the sender is only used if it is registered and approved at the provider for the recipient's country, and that the provider may replace it otherwise.

2. When the provider reports the sender actually used, show it in the test result and the contact's activity ("Requested: DemoTest, delivered as: …"), and flag any mismatch.

3. If the provider's API allows it, check the custom sender ID against the provider's approved list when it is saved, and block or warn before any message goes out.