Anyone can fall for a scam. And SMS spoofing is yet another cybersecurity problem that companies and individuals must learn about to avoid becoming the next victim.
If you miss the warning signs of an SMS spoof, the implications go far beyond an inconvenience. You could find yourself dealing with identity theft, ransomware, or a huge financial loss. Or you may even be the employee responsible for opening the door for a widespread attack on your company (and its customers).
Without you even knowing, you could just end up being an unwitting participant in a botnet that scammers use to conduct other nefarious activities that you’ll probably never know about, but that cause pain and suffering to others.
So it’s to your benefit, as well as society’s, that we all take a moment to get a clear understanding of what SMS spoofing is, and how to prevent it.
What is SMS spoofing?
Spoofing is bigger than just SMS. It can also happen over email and even through fake online ads. This broader idea of spoofing refers to situations where a cyberscammer masquerades as a trusted entity to trick end users into doing something that benefits the hacker – like clicking a link, downloading a file, or opening an attachment.
SMS spoofing refers to the specific scenarios possible on your smartphone through texting and is a type of SMS smishing. An SMS spoof can be an SMS message sent by a fraudster using an unrecognizable number, or even a recognizable one. As with other forms of spoofing, the spoof SMS will usually include some kind of link they want you to click on.
And if you take the bait, you may end up giving them access to valuable personal information, or downloading malware onto your device that will cause trouble later.
How does SMS spoofing work?
Spoofing is all about hiding the true identity of the person behind an act. With SMS spoofing, the scammer finds a way to make it seem as though their text message is coming from a different number or sender ID – often a real business or a person you may know whose device has already been compromised.
To be clear, the spoofed SMS can come from another victim’s physical mobile phone, or as an SMS message that appears to come from another person or organization.
If the person receiving the SMS message trusts the sender’s identity, they’ll be more likely to open it and click on whatever link the scammer sent. Once they do that, they’ve probably exposed some sensitive information about themselves or their company.
How can spoofing impact businesses?
Businesses are at risk of SMS spoofing in a few different ways. The first and most publicized problem is that when an employee at a company clicks on a malicious link in an SMS spoof, the fraudsters may be gaining access to company systems and customer data.
This can lead to customers being defrauded, or the scammer could use their access to implant viruses and crash a company’s entire digital infrastructure. They may also introduce ransomware and demand payment if the company wants to regain access to its data and avoid the costs of having that data exposed to the world.
The scammers could also use contact information for employees and customers to send more SMS spoofs to millions of other people and expand their potential victim pool by playing off the reputation and trustworthiness of the brand.
Companies may suffer lost consumer trust, costs to repair any internal damage to their databases, privacy leaks, and leaks of proprietary or potentially confidential information about employees, vendors, or competition can cause long-term, very expensive trouble.
Needless to say, in addition to the real costs of lost time and money trying to repair all this damage, the company’s reputation may also suffer a serious blow, which can impact future sales if customers decide it’s safer to do business elsewhere.
Six types of SMS spoofing
Here are a few common types of SMS spoofing that you might encounter on your smartphone device.
1. Fake sender ID
This common type of SMS spoof uses a trusted sender ID to mask the real sender. Typically, the trusted sender will appear to be a business, which will increase the likelihood of the victim clicking on whatever the text is telling them to do. Fake sender IDs can also be masked as someone else in your contact list, including fellow employees if the fraudsters are attempting to infiltrate a company’s network.
Example: “Your United Bank checking account may have been compromised. Click here to change your password immediately.”
2. Unsolicited bulk messages
This is what most people think of when it comes to spam emails. But you can get spam SMS messages too, and this type of SMS spoofing attack is sent for the same reason. The message could be on just about any topic and look like a promotional SMS message and may seem inane or absurd.
It may also have misspellings. Millions of people might receive the text, but the scammers just hope for a handful of them to click on the link in the message.
Example: “Some great pics of celebrities at award shows. Click to see more.”
3. Harassment
Harassment SMS spoofing can take many forms. Typically, it happens after the scammer has obtained some of your information through other cybercrimes they’ve already committed.
Now, with your contact information and other knowledge of your private life, they may threaten you with embarrassment or other outcomes if you don’t pay a ransom. Or they might lie and trick you into sending money for something fake.
Example: “Your friend is in legal trouble and is raising money for his defence. Please send money to help.”
4. Corporate espionage
This type of SMS spoof targets employees, usually within a larger company that may have valuable customer data, or the resources to pay a large ransom if the fraudsters can gain control over the company’s information.
Usually, when you click on links in messages like these, you may not be aware that anything bad has happened, because the hackers are using malware from your device to then spread to others within the company. You become the “trusted sender” used to trick your co-workers.
Example: “Our system has been updated. Please click here to reset your password.”
5. Fake money transfers
Here, the scammer promises money that needs to be transferred to the victim’s account. The sender’s name could appear to be from their bank, PayPal, or other recognizable financial institution or service, and the message will resemble a typical transactional SMS.
Their goal is to gain access to your bank account information. The message may refer to a cash back transaction that never took place, fake prize winnings, fake refunds, fake legal settlements, and other scams of this sort.
Example: “You were overcharged on your recent purchase. Please claim your refund by clicking this link.”
6. Identity theft
Scammers want whatever personal information about you they can get – anything like medical records, account information, passwords, Social Security numbers, credit card numbers, phone numbers, and more.
They want it so they can look for a way to pretend to be you and steal money. The idea is to make you pay for their stuff. Spoof text messages can be used to collect this information in a variety of ways.
Example: “Your health insurance needs to be renewed. Click here to update your account.”
SMS spoofing can take on many different forms, like in an unsolicited bulk text message or as a fake money transfer.
We should note that these types of spoofing can be done both at home and while a subscriber is traveling abroad – there's the case where fraudsters also can use the International Mobile Subscriber Identity (IMSI) to exploit roaming charges by sending spoofed SMS with high fees, leaving subscribers vulnerable to financial loss without them knowing immediately.
What distinguishes SMS spoofing fraud from other forms of text fraud?
Smishing, phishing, spoofing, spamming – there are all sorts of ways for scammers to cause you trouble through digital technology. SMS spoofing is just one of them. But it’s distinct from the others in a couple of key ways.
SMS spoofing is the only one where the scammer makes the sending name and number look like a person or business you trust. This makes it a bit harder to spot, and you really have to consider the content of the message itself. Would your friend, relative, or co-worker really send you this?
In SMS phishing attacks (aka smishing), most of the scammer’s goals are the same – get your sensitive information and use it against you or someone else. And many of their methods are the same – things like fake invoices, fake shipping notices, and many tactics listed earlier.
But you can usually spot other scams because the sender’s ID and phone number – or the email address in email scams – is suspicious. But with SMS spoofing, you may recognize the phone number or the sender’s name.
So you have to be extra vigilant to spot a fake message.
Prevent SMS spoofing
What can you do to protect yourself and others from falling victim to an SMS spoof?
First, your organization needs to teach this to its employees so they know how to recognize the warning signs of a spoofed SMS. By teaching everyone in your sphere of influence what should never happen, they’ll be more able to spot it and delete it when it does. Here are the major indications that you’re looking at a spoofed SMS:
-
Suspicious wording. Is this how your friend, co-worker, or company would talk? Would they say this?
-
Unfamiliar numbers. Does the text cite an account number or something similar you should recognize? If they look strange or incorrect, you need to take a moment to consider its legitimacy.
-
Spelling and grammar mistakes. It’s well known that most scammers can’t write very well, and this remains a telltale sign of a spoofed SMS.
-
Strange hyperlinks. Is this how company links usually look? Does it have weird formatting?
-
Unsettling requests. Any SMS asking for money or account-level information should be treated with suspicion – banks and other companies don’t do this.
-
False sense of urgency. Think about if the person texting you would use text messages to reach out to you about something urgent, or if they’d call you directly.
-
Anything that sounds too good to be true. Unsolicited luck doesn’t happen very often. Don’t trust it when it lands on you.
The main thing is, if you get a suspicious SMS, stop, think, and check before you act. Scammers rely on you not spotting warning signs, so if it looks suspicious, don’t click any links and don’t reply. If it’s from your company or from an employee, show it to a supervisor or go check with the person who supposedly sent it. If it’s from a relative or friend, call them to confirm.
As a business, consistency is key. Reinforce what actions your company will never take, like sending unsolicited links to reset passwords or requesting sensitive account information via text. This will help you reinforce consistency with your employees and trust with your customers, as they come to expect a certain level of security and integrity from your organization.
Additionally, your business needs to remain vigilant and proactive in addressing potential SMS spoofing threats. Recognize that SMS spoofing may indicate a larger breach of security, so you should promptly investigate any suspicious activity and take appropriate measures to mitigate risk, which may involve collaborating with law enforcement or cybersecurity experts if necessary.
In essence, your business must prioritize education, consistency, and proactive measures to enhance its resilience against SMS spoofing and other cyber threats and build trust in your operations.
Maintain your brand reputation by sending reliable SMS
As a business, make sure your messages are easily identifiable by your subscribers.
Here are a few strategies to make this happen:
-
Keep your branding consistent in all your texts.
-
Give clear contact details like phone, email, website, or a ‘reply HELP’ message so subscribers can verify your messages.
-
Tell subscribers how to opt out from your SMS list.
-
Regularly remind customers that you will never ask for personal information with SMS.
-
Use SMS verification like two-factor authentication and one-time passwords.
-
Tell customers to report any suspicious messages.
-
In the U.K. and U.S., tell subscribers can forward suspicious messages to the shortcode 7726.
-
Ensure your SMS service provider takes spoofing seriously and will work to block problematic messages.
-
Verify your provider’s external credentials, like if they’re part of the SMS Protection Registry, as evidence of their commitment to combatting fraud.
-
Use an SMS API for smoother integration and better security.
When it comes to SMS spoofing, everyone is in this together – employees, companies, customers, friends, and relatives. Anyone can become a victim, and anyone who has their contact information can be victimized as a result.
Stay informed. Stay vigilant. And talk about this stuff with everyone you know – including your kids once they’re old enough!
If you’re looking for external resources about scams, here a few good places to start:
As a leader in our sector, Sinch is committed to following the highest standards for transparency, accountability, data, and consumer protection. All companies using Sinch put their trust in us to safeguard their customers’ personal information. To be able to deliver on this expectation, we need to operate within a robust regulatory framework, actively working with others in the value chain to promote and advocate for best practice as well as seeking innovative solutions to help detect and prevent threats.
We also keep our chain of trust as short as possible, with over 600 direct carrier connections to operators. Learn more about our fight against fraud in SMS to stay informed.
