6 ms·
Smishing scam regarding debt for road toll services
- Bluescreenbuddy 3y agoI actually got one of these texts recently. Problem is, I don't drive or own a car. LMAO. I reported the domain they linked in the text to Cloudfare since WHOIS pointed to it.
- meepmorp 3y ago> Smishing: A social engineering attack using fake text messages to trick people into downloading malware, sharing sensitive information, or sending money to cybercriminals. "Smishing" combines "SMS"—or "short message service," and "phishing." "Phishing" generally pertains to attacks on the internet, email, or websites.
- ChrisArchitect 3y agoDidn't know smishing was that common a term for this enough for its use here
- jwally 3y agoI don't know how well it would scale, but from an ease-of-use perspective it feels like Quishing (eyes roll - QR Phishing) is a plague waiting to explode. "Just scan this and donate to the red cross!". My kid's afterschool provider had some sign up form for an event they're hosting - with a QR Code to sign up / pay - which was some random third party provider. Legitimate, but _painfully_ easy to spoof...
- jwally 3y agoAlso, juvenile shenanigans with links to goatse et al being placed on the local plumber's van feels like an easy win for 17 yo boys everywhere.
- toast0 3y ago> links to goatse The Email service? why would people link to that? :P
- londons_explore 3y agoThe typical 17 year old hasn't even heard of goatse these days.
- fckgw 3y agoThere was an explosion about 6-7 months ago reported on Reddit in the amount of phishing emails with QR codes in them. Because they have no URLs in them and the actual phishing happens off-device with no endpoint security, they seem to be bypassing a lot of filters. https://www.reddit.com/r/sysadmin/comments/16oh8ar/how_is_everyone_mitigating_the_increase_in/ https://www.reddit.com/r/sysadmin/comments/16oh8ar/how_is_ev... https://www.reddit.com/r/cybersecurity/comments/16mn6ve/how_do_you_deal_with_qishing_qr_phishing_at_your/ https://www.reddit.com/r/cybersecurity/comments/16mn6ve/how_...
- gs17 3y agoThe parking here in Nashville got privatized (and made much worse, even 1 minute costs $2 now and no more free times/days) and the pay method uses a QR code. I am amazed no one has gone around putting fake QR codes on the signs. They'd even work better, the non-standard codes they printed don't really scan well.
- WarOnPrivacy 3y agoI used screenshotmachine.com to look at myturnpiketollservices dot com. It looks like the site is behind Cloudflare and CF has marked it as a phish (w/ an ignore & proceed link).
- mistercheph 3y agosmishing is such a stupid term -- this is the kind of nonsense they invent and then test for on CompTIA et al cert exams
- macshome 3y agoI found out about smishing and vishing from some mandatory security training at work. It’s all just phishing to me, I don’t get the need for all the other terms.
- myself248 3y agoIn my day, we called it lying!
- imacomputer 3y ago> It’s all just phishing to me, I don’t get the need for all the other terms. A. Someone wants to feel important, and write a book about it. "Read my linkedin post bout vishing... hire me for your workshop" B. Someone is trying to highten job security. "You cant get rid of me I am the vishing expert"
- deleted 3y ago[deleted]
- Scoundreller 3y agoLucky for all you in US reporting these things. For the Canadian targeted ones, they generally geo-target the page (Canadian IP = scam, foreign IP = no scam presented) and it’s an ordeal trying to get stuff taken down. I try at domain, SSL, host, Google safe search, netcraft levels and it’s often a waste of time. Drives me bonkers when it gets assessed as “safe”.
- euniceee3 3y agoWild to see the extreme Smishing plus IMSI grabbing to then use an SDR to send the SMS without going through an SMS Gateway. https://commsrisk.com/chinese-arms-dealer-sold-imsi-catchers-for-huge-paris-drive-by-smishing-scam/ https://commsrisk.com/chinese-arms-dealer-sold-imsi-catchers...
- Scoundreller 3y agoI thought SMS gateways weren’t really used anymore and the way to go was to buy a bunch of prepaid unlimited SIMs and blast out messages at a below-detection rate through thingies that rotate between 64/128/256 SIMs and 8-16 radios. Like shown here: https://au.finance.yahoo.com/news/how-one-man-allegedly-cost-aussies-millions-sending-17m-fake-text-messages-230734486.html https://au.finance.yahoo.com/news/how-one-man-allegedly-cost... The IMSI catching approach, wow!
- londons_explore 3y agoMany simply get some proportion of their customers to install a malicious app which sends the spam from the victims phone number.
- John23832 3y agoTotally secondary, but we could solve this by not giving the revenue rights for pubic good (parking meters, expressways, etc) to private companies which then have random toll websites. Just saying.
- Scoundreller 3y agoIunno, the EZ-Pass website looks designed a few decades ago.
- uxjw 3y agoDon't they already scam people by duplicating government websites?
- renewiltord 3y agoInteresting. I see what you mean. Limiting it to .gov domains would make this hard to do but that cat is out of the bag and, in practice, we're better served with an open bidding process. However, I did find it painful just now to find who etimspayments.com is since they're using domain privacy even though they are the SF provider https://wmq.etimspayments.com/pbw/include/sanfrancisco/input.jsp https://wmq.etimspayments.com/pbw/include/sanfrancisco/input... I was just talking to a friend and he put in a CPRA request to find out which LLC provides that service so we'll know soon enough.
- paulgb 3y agoThe FBI should become a virtual credit card issuer and allow anyone who thinks they are being scammed by a phishing/smishing/etc. scam to generate a fake card (with no balance attached to it) to give to the scammers. Seems like that would give them enough information to track down the bad guys, or at least to track down their enablers.
- ronsor 3y agoPeople would blacklist FBI VCCs
- tgsovlerkhgsel 3y agoHard to do if the FBI were to work with several major banks and getting numbers from their ranges. And obviously the numbers would be single/limited use.
- e40 3y agoIf they wanted to trace the transactions, it wouldn't require anything as complex as this. They could trace existing transactions with a warrant, which I assume would be easy to get. The truth is, LEO don't give a shit about these types of crimes, because the CC companies have the fraud already built into their business models (e.g., they've priced in losses).
- tgsovlerkhgsel 3y agoMany such scams must work, otherwise they wouldn't keep happening. I suspect CC companies refund the ones who complain, but enough victims of smaller scams never complain and thus it pays off. What would help is shared liability, and mandatory full refunds for all victims, not just those that come forward. For example, a consumer protection agency or association could prove that a certain company was scamming, and get a court order forcing the payment companies to reverse all transactions associated with that company. Suddenly, all those "FREE SUBSCRIPTION *turns into a $49/month, 6 month minimum subscription if not cancelled within 7 days" (with the "free" repeated in huge letters and the subscription terms hidden in the finest fine print) scams would become risky enough that the payment providers would no longer be happy to enable them for a small percentage of the loot.
- Luc 3y agoLooks like the hardware he was using is on AliExpress: https://www.aliexpress.com/item/1005006609463852.html https://www.aliexpress.com/item/1005006609463852.html
- babyshake 3y agoAnyone else think the the term smishing is too cute and confusing, and "text message phishing" should be used instead?
- yamazakiwi 3y agoI refuse to say smishing aloud. Tishing would be more easily inferred than Smishing if they want to keep the phishing part for recognition. I can't find or think of any other examples in English where we combine a word with an acronyms first 2 letters pronounced phonetically. Lollercopter?
- teeray 3y ago> visit https://myturnpiketollservices.com https://myturnpiketollservices.com to settle your balance This is partly the fault of these rent collectors—they all use some shady-sounding but vaguely-related third party to settle fines (something like paymyparkingticket.com or paymyhospitalbill.com). Use your own domain, put a subdomain on it, and CNAME over to the third party so we can have some trust.
- bhawks 3y agoId imagine most of the customers of paymyGENERIC_SERVICE.com would see not having to touch DNS as a useful feature of the payment collection service.
- inkyoto 3y agoThis scam has been going on for a few years and outside the US as well, I just received another two such scam texts overnight. They pretend to send payment demands as local toll operators although links do not look convincing. I ended up logging a support ticket with my local telco 2-3 years back, and got a phone call back from an engineer who stated that the scam messages are mostly spread by infected (unpatched) Android phones that the malware runs on. The curious thing the engineer also mentioned was that they were applying mitigations on the telco side – to suspend the infected phones from accessing the mobile network and notifying the user of the problem. Although with many Android phones no longer receiving security updates any more, I am not sure what the recourse could be for an average user Joe.
- adamdigi 3y agowe're shutting down approx 3,000 phone numbers per week re: SMShing and Vishing scams apurcell@opsecsecurityonline.com