Phone networks admit they cannot stop scam text epidemic

mobile scam

Mobile networks have admitted they cannot filter dangerous messages that are costing innocent people thousands of pounds.

Scammers are running riot while mobile phone companies face a losing battle against a text message fraud epidemic. Britain’s banks have been forced to act, refunding millions to fraud victims, but now experts say mobile providers must urgently upgrade security.

Richard De Vere, director of the AntiSocial Engineer, a cybersecurity consultancy, said businesses should not send SMS text messages at all to protect their customers.

There has been a spike in consumers reporting suspicious texts as scammers impersonate parcel delivery firms, banks and Royal Mail, taking advantage of locked-down workers shopping online.

In recent years public bodies, banks and other big companies have used texts to communicate with customers and send them confirmation codes as a security measure, which has led to consumers trusting the messages, despite huge holes in SMS security.

“We can’t even pretend that we can trust it any more,” said Mr De Vere. “It’s really old tech, but scammers are just starting to understand how powerful it is.” Phone companies “need to care,” he said and “see the bigger picture”, and ultimately dropping the technology.

SMS text messages are an attractive option for companies and even governments to communicate because of their ubiquity – nearly all mobile phones can receive them.

But they were never intended as a mass communication tool, said Mr De Vere. “There is no authentication,” he said, which means a message can present itself as being from a bank or a delivery firm when it’s really from a criminal.

Used correctly, text messages can help cut fraud by issuing warnings and notices, such as about new payees. But this system teaches customers to trust texts – and it is this trust that scammers then take advantage of.

Anushka Lahiri, 18, from Birmingham, lost more than £5,000 after she fell victim to a scam text purporting to be from Royal Mail. Ms Lahiri had recently moved to Britain from Singapore to study medicine when she received a text asking her to pay a small fee for a Royal Mail package.

After she had paid the fee, she received a call from a number that showed up on her phone as being from Lloyds Bank.

She said: “The lady on the phone was very sweet and told me that someone had been using my account. She had me transfer every penny I had into a ‘safe account’ in my name, which I know retrospectively was incredibly stupid, but by the time I realised it was too late.”

After she contacted Lloyds she was eventually reimbursed around £1,150, which was all the fraudsters had left in the account.

She said: “Lloyds said there was no insurance for bank transfers and there was no way they could refund me the remaining £3,860. I broke down into tears.”

Ms Lahiri has now filed a complaint over Lloyds’ handling of the case with the Financial Ombudsman Service. Royal Mail said it would send email and text notifications to customers only if the sender had requested them for trackable parcels. Lloyds said it was investigating the case.

Peter Henderson, 63, from London, who initially lost £3,000 to a text scam before his bank refunded him his bank, said: “It was a horrible experience. One gets angry and emotional while it goes on, and this affects your judgment.”

A vicious circle keeps the technology in use, said Mr De Vere. Companies and government use it, so phone companies and manufacturers support it, which means companies and government can use it.

Vodafone, O2, EE and Three, the biggest mobile operators, would answer questions only through their lobby group Mobile UK and declined to say how they were individually tackling scams.

Mobile UK said the industry had put in place measures to combat fraud. It said it had helped launch a programme last year called SMS Sender ID, which protects certain government and brand names from being misused and helps share data on scam texts. But it admitted that there was currently no way to filter spam in the way email providers have been able to do for decades.

The industry encourages customers to flag suspicious texts themselves, but Mobile UK refused to say how many had been reported.