How fake delivery texts fuel a fraud empire

Text message scams, also known as smishing, are the backbone of a global fraud empire worth billions. They're becoming slicker and trickier to detect, putting the public at even greater risk. 

Criminals can blast out texts by the thousands, knowing that 98% of messages are opened – usually within 90 seconds. A high hit rate and captive audience make text messages a highly effective tool for distributing scams about unpaid parking fines, rescheduled deliveries and dodgy tax rebates.

When you click the link, you might be redirected to a fake payment site that harvests card details, or be prompted to install a malicious app that runs in the background, collecting your personal and financial data. 

A text could also be the first stage of a two-pronged attack, as bank impersonation scams often start with a fake delivery message. 

Read on to find out how text messages are fuelling fraud, what is being done to stop this and how to stay safe.

The rise of industrialised fraud 

One rapidly growing tier of cybercrime is ‘fraud-as-a-service’, which allows amateurs to buy bespoke fraud tools, no doubt turbocharged by artificial intelligence (AI). 

Take the text-scam operation dubbed 'Lighthouse', which sells ready-made templates and support to wannabe scammers on a subscription basis. It’s estimated to have reached a million victims across more than 120 countries. According to a Google lawsuit, it was backed by a Chinese cybercrime group.

‘Ten or 20 years ago, you had to be quite technical, but criminal offerings like this mean that someone with low levels of experience could get their hands on a dummy website and a phishing kit in about three minutes,’ says Garry Lilburn of non-profit intelligence organisation Cyber Defence Alliance. 

A scam toolkit known as Magic Cat, traced to a Chinese developer and uncovered by computer researchers at Norwegian cybersecurity firm Mnemonic, highlights the industrial scale of modern fraud. For a weekly licence fee of little more than £100, this software facilitates an entire fraud operation, complete with hundreds of copycat website templates (say, Evri and Royal Mail) and is thought to have harvested details of 884,000 payment cards globally in just seven months. 

The scam begins with a fake text, prompting you to click a link to pay a nominal fee, for example, to get a package redelivered. If you click through, you’re shown a perfect replica of the expected website, apart from the web address. As you enter your card details, each character is streamed in real time to a Magic Cat operator. 

When your bank issues a one-time passcode (OTP) as a security check, you might enter this too, assuming you're authorising a low-value payment to a trusted firm. By the time you close your browser, the scammer has added your stolen card details to a digital wallet on their own device.

• Find out more: What to do if you click a phishing link

Digital pickpocketing 

The popularity of mobile wallets has made them an obvious target for scams. 

Scammers only need to successfully target you once to empty your account. Some are patient, waiting weeks or even months after stealing your card details, when you and your bank are less likely to sound the alarm and freeze your card. 

Others are wilier still, calling from a spoofed number from your bank’s ‘fraud department’ to convince you to surrender the OTP sent by your bank, promising this will secure your account or cancel a payment. 

Banks have known for years that scammers use social engineering to get hold of OTPs. They also know that SMS is one of the least secure ways to deliver sensitive data, yet most still do this. 

SMS is also susceptible to Sim-swap attacks, where fraudsters convince a mobile provider to transfer your phone number to a Sim card they control. This enables them to intercept OTPs and potentially take over your banking, email and social media accounts. 

• Find out more: Networks must do more to stop Sim-swap scams

First in Which? Money magazine

This story first appeared in Which? Money magazine. Join for reviews and investigations, plus 1-to-1 guidance from our experts.

Join Which? Money

Only £49 per year

Fraudsters exploit platforms

Security experts warn that scammers have quickly realised that abusing iMessage (Apple) and RCS (Rich Communication Services – Google) offers them significant benefits over traditional SMS.

This is because mobile networks can scan SMS messages for suspicious links and block them before they ever reach your device, whereas iMessage and RCS are fully encrypted and route messages over the internet. Although this is great for privacy, it shields the content from the automated interceptors and filters that networks use to stop scams. 

‘RCS has become their primary method because they know it's not being filtered in transit,’ says Ian Matthews, founder of cybersecurity company WMC Global. 

Both messaging platforms support advanced messaging features that appeal to scammers, including video files and high-quality images such as corporate logos, which can give fake messages a more polished look and veneer of legitimacy. 

They can create group chats named after trusted brands such as banks and government agencies, adding dummy user accounts to trick you. Scammers even get read receipts telling them exactly when a potential victim has read their fraudulent message, which could be used to time the second step of an attack to perfection.

This means that responsibility to stop scam texts is shifting away from networks to Apple and Google, yet these tech giants aren’t necessarily best suited to the task. Their infamous ‘walled garden’ approach means they don’t tend to work with third-party security firms. They don’t share intelligence with banks either, even though the payments industry bears the reputational and financial burden when customers are scammed. 

‘Data sharing should be the top priority in fraud prevention. There is a conflict between privacy regulations and consumer protection, but there must be a way to strike a balance. Banks have found a way to share fraud data, yet other parts of the ecosystem are lagging behind,’ says Matthews. 

• Read more: Are scam filters doing enough to catch dodgy texts?

How card fraudsters cash out 

Following the trail of stolen card details is as revealing as it is disturbing. To better understand laundering methods, researchers at University College London conducted a unique operation. 

Dr Sharad Agarwal, whose PhD research focused on the lifecycle of SMS scams, partnered with a UK payment processor to monitor stolen credit card details online. These had been intentionally shared with SMS scammers to identify transaction patterns and cash-out methods, safe in the knowledge that these would be blocked because the scammers were given incorrect expiry dates.

‘When you try to use card details online, as opposed to a physical machine, a token is sent to the bank to say “somebody’s trying to authorise this card”’, explains Dr Agarwal. ‘When that ping happens, the bank can monitor the transaction data, so we took that raw data and translated it into something more meaningful.’ 

He found that the credit card thieves attempted to cash out not only in the UK, but also in Canada, Ireland, the Netherlands and the US. They tried to buy tools and services they could use to conduct further scams, such as VPN services and Sim cards. 

Taxi and food delivery apps were also on the hit list, likely because rogue activity flies under the radar due to the high volume of normal transactions. 

What can be done to stop scam texts?

The regulator, Ofcom, set out new measures for the mobile industry to tackle scam text messages.

Among these measures, Ofcom has stated that mobile providers must:

• Block numbers used by scammers.
• Detect malicious links and numbers to block scam messages.
• Set message limits for pay-as-you-go Sim cards to prevent scammers from sending bulk messages.
• Carry out further due diligence checks on customers.
• Prevent the use of fake sender names.

Although these measures are likely to help reduce the number of scam texts, they won't have an impact on scam messages sent through RCS and iMessage.