As mobile messaging evolves, so do the tactics of fraudsters. Smishing may make the headlines, but it’s only one of many types of fraud threatening mobile networks today.
For MNOs, understanding these diverse fraud types and implementing a multi-faceted defense strategy is essential to protecting subscribers, maintaining trust, and avoiding revenue losses.
In this blog, Openmind Networks’ messaging experts dive into the various forms of messaging fraud impacting mobile networks and discuss why a comprehensive fraud prevention strategy is critical for operators.
1. Smishing
What is smishing?: Smishing involves sending fraudulent messages that trick users into revealing personal information, such as passwords or credit card details. These messages often look legitimate, masquerading as banks, delivery services, and other trusted brands. Smishing messages typically aim to alarm the recipient, claiming an urgent action is required. Once a user is duped into clicking a link or replying with sensitive information, the fraudsters gain access to their personal data, which can lead to financial fraud and other malicious activities, or install malware on the user’s device.
Smishing (messages containing fraudulent links to bogus websites) is perhaps the most well-known form of messaging fraud, but it is just one part of the messaging fraud landscape.
2. SIM Swap Fraud
What is SIM Swap Fraud?: SIM swap fraud occurs when an attacker convinces a mobile carrier to transfer a victim’s phone number to a SIM card they control. Once they have access, the fraudster can intercept calls, texts, and most importantly, One-Time Passwords (OTPs) used for two-factor authentication. This allows the attacker to take over social media accounts, banking apps, and more.
SIM swapping is a tactic often combined with other fraud types, where fraudsters use a compromised SIM card to access an individual’s accounts or intercept their messages. This tactic allows attackers to access a user’s messaging account and further exploit it for financial or personal gain. SIM swapping remains a pervasive threat and reinforces the importance of layered security protocols for critical accounts.
SIM swap fraud is particularly dangerous because it bypasses traditional SMS-based authentication, leaving subscribers vulnerable even if they are careful with their devices. Operators can ensure SIM swap is avoided by having strong personal identification protocols in place when SIM swap is requested.
3. SMS Spoofing
What is SMS Spoofing?: SMS spoofing involves sending messages that appear to come from a trusted source, such as a bank or service provider, by manipulating the sender ID. Recipients may believe these messages are legitimate and respond with sensitive information, providing fraudsters with easy access to accounts or other personal data. Spoofing erodes user trust, as customers can no longer be certain of the origin of a message.
4. Spam
What is Spam fraud?: Spam messages flood users’ inboxes with irrelevant or unsolicited offers, often promoting products, services, or dubious schemes. While not always harmful, spam can lead to smishing attacks or malware downloads. For operators, spam represents a significant challenge as it clogs networks, frustrates subscribers, and reduces overall trust in messaging as a secure communication channel.
5. Access Hacking
What is Access Hacking?: Access hacking occurs when fraudsters gain unauthorized access to messaging platforms or accounts, allowing them to send messages under the guise of legitimate users. This can be used to send fraudulent messages, phish for sensitive information, or conduct scams. Once access is compromised, fraudsters can leverage user accounts for further attacks, amplifying the impact on both operators and subscribers.
6. Artificially Inflated Traffic (AIT)
What is Artificially Inflated Traffic?: AIT refers to the artificial generation of messaging traffic to inflate costs or exploit revenue-sharing agreements. Fraudsters will set up automated systems to, say, request a one-time-password to login to an account. Sending these OTPs in large volumes generates a lot of money from nowhere essentially as operators have to charge someone for the termination of those messages. AIT results in financial losses to private businesses, individuals and operators and can disrupt services, making it essential for operators to identify and block such activities swiftly. This is currently the biggest issue on networks for operators as it is so difficult to prevent.
7. Grey Routes
What are Grey Routes?: Grey routes are messaging channels that exploit legitimate pathways without permission or revenue sharing, allowing messages to bypass standard billing and security protocols. An example would be the use of cheap or free P2P message routes in order to send business messages. By using the P2P routes the higher termination fees that apply to business messages are avoided and operators do not get the correct amount of revenue for the traffic they are handling.
Often originating from overseas, these messages use legal routes for unauthorized traffic, costing operators in revenue losses and affecting network efficiency. Grey routing can undermine legitimate business messaging, necessitating advanced filtering by operators.
8. SIM Farms
What is a SIM Farm?: SIM farms are collections of SIM cards used to send bulk messages, often for grey route fraud or for smishing campaigns. By using multiple SIMs, fraudsters can evade detection and bypass network limits, sending vast quantities of messages from different numbers. This method is highly disruptive, costing operators in lost revenue and damaging the user experience by clogging networks with spam.
SIM farms are being exposed by policing agencies worldwide all the time but the ease with which they can be set up, moved and disbanded makes the detection of these farms very difficult.
9. International Premium Rate Number (IPRN) Fraud, aka International Revenue Share Fraud (IRSF)
What is IPRN Fraud?: IPRN or IRSF involves fraudsters tricking users or systems into making calls or sending messages to premium-rate international numbers. The fraudsters then earn revenue from the charges accrued. Operators face significant financial losses from this type of fraud, as fraudsters may generate thousands of calls or messages to these premium numbers in a short period.
This is actually a very straightforward fraud to prevent with large financial upside for operators but it is not well understood and so remains on networks undetected.
10. Trashing
What is SMS Trashing?: SMS trashing is a form of business SMS fraud that primarily targets organizations sending A2P SMS, rather than individual consumers. In this scheme, dishonest SMS providers or aggregators exploit their role as intermediaries by failing to deliver all the messages they are entrusted to send on behalf of businesses. Instead, they siphon off a portion of these messages and don’t submit them to MNOs for actual delivery. Despite this, they still charge the businesses as if every message had been successfully delivered, profiting from the undelivered messages.
To avoid detection, fraudsters usually keep the proportion of trashed messages low – around 10% – to ensure that companies don’t immediately notice the discrepancy. In cases where delivery reports are expected, these providers may generate fake delivery receipts, giving the appearance of complete message delivery. This fraud typically affects marketing and promotional SMS, where confirmation of receipt is hard to verify. While it’s challenging to quantify how widespread SMS trashing is, businesses can remain vigilant by closely monitoring delivery metrics and partnering with trusted SMS providers.
Conclusion
The spectrum of messaging fraud tactics demonstrates the constant evolution of threats faced by mobile network operators. From smishing to SIM farms, fraudsters continue to find new ways to exploit vulnerabilities in mobile messaging. For operators, investing in robust fraud prevention technology is essential – not only to protect users and revenues but to ensure trust in messaging as a secure communication channel.
A comprehensive fraud prevention strategy should include advanced filtering, monitoring, and detection capabilities tailored to different types of fraud. By staying informed and proactive, operators can safeguard their networks, minimize financial losses, and continue providing a secure messaging environment for all users.
To learn more about the topics covered in this article, or to discuss how Openmind Networks can help you mitigate the risk of fraud on your network, please get in touch or contact our team of messaging experts online here.
