SMiShing & Vishing News

Get cutting-edge SMiShing and Vishing security news and catch up with the latest trends in phone fraud and text messaging attacks. http://numbercop.com

[numbercop]

NumberCop joins Whitepages in fight against unwanted calls and texts

It's my pleasure to announce today that NumberCop has been acquired by Whitepages, the leading source for phone and digital identity data in North America.

NumberCop's phone and text scam protection solutions will enable Whitepages to boost its phone reputation services and expand Whitepages’ spectrum of Caller ID based risk intelligence for both businesses and consumers.

Starting today, Whitepages will integrate NumberCop's phone and text scam protection into Whitepages’ existing app portfolio, including Whitepages CallerID for Android.  Joining forces with Whitepages is an incredible opportunity to extend NumberCop's mission to the Whitepages’ significant user base.  I am proud of the impact that this partnership will have to fight fraudsters and spammers and protect consumers and businesses from fraudulent calls and texts.  NumberCop's Phone Spam Blocker services for iPhone and Android devices will operate until the end of 2015 .

I want to thank our users, customers and partners for your trust, support and business over the recent years and invite you to connect with Whitepages for ongoing insights about phone reputation for both consumers and businesses.  

Jan Volzke Founder & CEO http://numbercop.com

[numbercop]

Weekly summary 5/18-5/31

Quick summary from NumberCop’s Smishing and Vishing research lab: Malicious phone phishing campaigns resumed at full speed over the last two weeks; our data confirmed targeted Smishing attacks for: Bank of America, Wells Fargo, Chase, PNC Bank (Recording here), DirectExpress, Western Union, Visa and up north Scotiabank, TD Bank and Royal Bank of Canada.

Meanwhile many Verizon, AT&T and T-Mobile customers experienced another spike in spammy SMS chat-bots driving traffic to adult sites combined with numerous account take over attempts. Things appeared to be more quiet in UK and Australia as law enforcement stroke 3 times in these markets recently.

Weekly sampling attached. Contact us for in real-time threat intelligence via NumberCop’s API.

[numbercop]

Weekly summary 5/4-5/17

Welcome back to your weekly summary from the Vishing and Smishing front. After several calm weeks we’ve seen campaigns resume on regular intensity, targeting Bank of America, Wells Fargo, Chase, PNC Bank, Palametto FCU (CO), Boing Employee Credit Unions (WA). 

Several campaigns went through 3 or more targets in 48h, which we haven’t seen for a while. On the Vishing side activity was rather soft targeting a smaller group of Capital One (8559683131), Bank of America (7188889961), CBC FCU (CA) (8887585316) and again Boing Employee Credit Union (WA). 

AT&T and Apple account take over Smishing resumed as well. Internationally, Smishing was detected in Canada where Scotiabank and Bank of Montreal became targets, as well as Westpac (Australia).

Weekly sampling below or real-time via NumberCop’s API. Contact us for details.

[numbercop]

Weekly summary 4/27-5/3

And another quick summary of last week's action on the Smishing and Vishing front in the Financial Sector. New Smishing activity was on the typical to low side with targeted campaigns for Bank of America, Wells Fargo (multiple campaigns), Chase, Bank of Montreal (Canada), Natwest (UK) and Barclays (UK), Vishing however continued to pick up. 

Two numbers were particularly active (8888931773, 8885030711) impersonating Suntrust (8888931773), EECU Credit Union (8885030711) and Texans Credit Union (8885030711). Recipients of these calls were informed about their Debit or Credit card accounts being blocked and prompted for their card credentials via IVR.

[numbercop]

Weekly summary 4/21-4/26

We're closing our trackers for another mildly active Smishing week with only a handful records: Bank of America, Wells Fargo, Chase Bank, Talmer Bank, MBT Bank, Woodforest National Bank, Scotiabank (Canada) and Natwest (United Kingdom) were among the Smishing targets.

On the Vishing side Sunmark FCU issued an alert after a significant robocall phishing campaign via 888-203-3740. This campaign was geographically pretty broadly targeted, so we assume other FI's in the Albany, NY / 518 area codes were affected.

Carrier account takeover attempts continued to target T-Mobile and Verizon customers. Group-SMS targeting 25 or less users are the preferred distribution channel for these campaigns and effective traffic drivers to well known phishing sites.

[numbercop]

Weekly summary 4/14-4/20

Finishing an atypical calm Smishing and Vishing week 4/14-4/20. Besides a few standard FI Smishing campaigns targeting Bank of America and Wells Fargo - NUMBERCOP tracked only a handful of additional targeted campaigns namely for Firth Third Bank and Omaha Mutual (NE). On the Vishing side M&T Bank area codes were hit again (consistently using caller ID 8774637786) and Barclays nation-wide (via 8664674713).

Internationally, Bank of Montreal (Canada) and Natwest (UK) were continued targets. We collected further details that Natwest's Smishing campaign uses a Spoofed Sender ID, (instead of a hijacked Sender ID as believed earlier) for sending out Smishing text messages. With Natwest now being targeted non-stop for 2nd months it becomes evident how hard it is for an affected brand to shut down and non-compliant SMS VAS in the UK.

Within the wider Smishing news we recommend to follow a few sessions at this years RSA Security Conference taking place in San Francisco this week. In particular Cathal Mc Daid's session on Smishing (details here, presentation attached) which should be largely in line with NUMBERCOP's Spam Research.

As always please find our weekly Smishing sampling below and on our API for further details.

[numbercop]

Weekly summary 4/6-4/13

Quick recap as we're wrapping up a another busy Smishing and Vishing week. Targeted attacks were recorded on Wells Fargo, Bank of America, PNC Bank (Recording: bit.ly/1GIMiY5), Fifth Third Bank, HarrisBank and once again Boeing Credit Union (Recording: bit.ly/1O1lzGF).

Looking abroad NUMBERCOP detected Smishing campaigns targeting Bank of Montreal (Canada), Natwest (UK), O2 (UK), British Telecom (UK), Tesco (UK) and Bancolombia (Colombia).

Back in the US renewed Vishing activity was tracked especially in the 2nd part of last week targeting M&T Bank, Barclay Card and again Boeing Credit Union. We also saw the re-emergence of SMS Chat bots, which have been notability absent since the beginning of the year.

Weekly sampling below or realtime via our API's.

[numbercop]

Weekly summary 3/30-4/5

Here comes your NUMBERCOP Smishing summary for last week; majority of activity targeted Wells Fargo, Bank of America, Chase (significant activity), Regions Bank, Fifth Third Bank (OH), Chief Financial CU (MI), Boeing Credit Union (WA), South Side Bank (TX), Education First FCU (TX) and numerous generic "(Card Blocked)" campaigns.

Particular attention was on Boing Credit Union last week. The 4th largest credit union, which a very strong footprint in the Seattle (WA) metro area, was targeted multiple times last week, first via Vishing robocalls, followed by 2 distinct Smishing text campaigns.

Meanwhile in the UK Natwest type smishing (via hijacked Sender IDs) expanded even further with targeted attacks on Santander, after Lloyds Bank as reported previously.

[numbercop]

Weekly summary 3/23-3/29

Quick summary from the Smishing & Vishing front last week. NUMBERCOP tracked new targeted Smishing campaigns for Bank of America, Wells Fargo, Chase, BBVA Compass (Recording: bit.ly/1D2PO01), Alabama State Employee Credit Union and a continuation of NCUA's (National Credit Union Association) debit card smishing.

The NCUA Smishing campaign used the associations reference only for it's inbound IVR while text message lures were kept generic. While not targeted directly, this prompted alerts from a variety of CU's incl. ICU Credit Union (MA), Regional FCU (IN), Peoples Bank (WI), Cape Cod Cooperative Bank (MA), Peoples Advantage FCU (VA), Security Credit Union (MI) and Wesla FCU (LA).

Most of last weeks action however was in Canada. With tax season in its final stretch Phishers targeted the Canada Revenue Agency (Canadian IRS) in a massive Smishing campaign driving traffic to a very high quality phishing site with links to 6 (fake) Canadian bank logins (ATB, BMO, CIBC, HSBC, RBC, TD Bank, Scotiabank, Laurentian Bank, Manulife Bank, National Bank and President's Choice Financial). That same site also received traffic from a separate TD Bank Smishing campaign. Enough for prime time news about Smishing all over Canada last week.

Meanwhile in the UK NUMBERCOP collected further evidence of a widening Natwest's Smishing campaign, which has now expanded to Lloyds Bank. With nearly identical syntax compared to Natwest this campaign hijacked (or spoofed) once again previously legit Sender IDs (Alphanumeric Shortcodes).

A few weekly samples below, please contact us for API access & live coverage.

[numbercop]

Weekly summary 3/16-3/22

Last week saw a very active Smishing week with targeted attacks on Wells Fargo, Bank of America, BBVA and Discover Card. Most of the action however targeted specific Credit Unions with Philadelphia FCU and especially Alabama State Employee CU. 

In parallel a general Smishing campaign "Your Credit Union card has been temporarily locked!" triggered alerts from Centinel Bank (NM), Peoples Bank (NM), Spokane Federal Credit Union (WA), River Bank & Trust (AL) and APCO Employees CU (AL). 

Interestingly, most inbound IVR recordings referenced "National Credit Union Association" (recording here) which recently educated its' Credit Union Members about email phishing. NCUA's timing was right, but they forgot to mention that phishing frequently uses SMS to attack those chronically under-protected mobile users.

Across the pond, Natwest (UK) Smishing continued for a third week, while new campaigns were recorded for BMNA (UK), Westpac (Australia) and TD Bank (Canada). Smishing traffic related to TD Bank continued on that url also for the 3rd week before getting disconnected by Goo.gl.

[numbercop]

Weekly summary 3/9-3/15

Last week saw rather front-loaded Smishing & Vishing activity targeting again Bank Of America, Wells Fargo, Chase and a Smishing-Newcomer PayPal with additional warnings from GermanAmerican Bank (IN) and Valor Credit Union (PA). 

Internationally Smishing resumed in Canada targeting TD Bank and RBC in parallel to a widening Smishing campaign for Natwest in UK (read statement).

What is interesting about the Natwest case is that the "NATWEST" Sender ID (alpha numerica short code sender - not available in US/CA) was legitimately used by Natwest last year, but appears to have been hijacked since the last couple of weeks.

Back to the US: that massive Verizon smishing campaign we reported on last week was quiet all week but resumed with similar force over the last 48h. Again dozens of numbers were involved driving traffic to various clickadx[dot]com and etoranj[dot]ir phishing destinations. 

Upon further investigation on the tools/platforms used for this weeks campaigns we found additional evidence pointing to Twilio (or a Twilio enabled) platform. In both Verizon and Paypal campaigns some victims replied to these SMiShing texts only to see a Twilio-like response using their standard SMS reply template (more). Clearly, processing replies or even preparing for victims to reply was not a priority for these campaigns.

[numbercop]

Weekly summary 3/2-3/8

It looked like a typical phone phishing week with most activity targeted towards Wells Fargo and Bank of America, however events turned dramatically once the weekend started. 

First there was targeted Smishing on American Express holders (recording bit.ly/1E4LrOX) followed by a massive Verizon Smishing campaign - using probably the widest number range NUMBERCOP ever tracked in a Smishing campaign. More than 50 numbers were involved sending links to bogus Verizon account sites, starting Sunday 4:30pm PDT and continued traffic through out the night to Monday. 

On the Vishing side Bank of America and Wells Fargo saw continued Robocall Vishing incidents (via 3128944630, 5133622035, 5128287272, 7735252727, 9072029003) with varying brand affiliations. Overseas NatWest (UK) and RBC (Canada) Smishing (via reac[dot]mobi) continued for the 4th week.

Please contact us for complete coverage via NUMBERCOP's API.

[numbercop]

Weekly summary 2/23-3/1

That last week in February saw some atypical but interesting Smishing & Vishing traffic. We recorded reduced weekend Smishing activity (weekends are usually prime-time) while voice based attacks increased significantly.

Targeted Smishing campaigns focused on the earlier part of the week: Bank of America, Wells Fargo, BB&T, Great Western Bank, Bank North West, US Bank plus a generic Smishing campaign triggered phone scam alerts were issued by Awakon FCU (MI), Wildfire CU (MI), Hastings City Bank (MI), Consumers CU (MI) and Village CU (IA). Text based account take-over attempts continued for AT&T, T-Mobile and Verizon. We also saw a new smishing campaign targeting UK's tax payers (HMRC).

Most action however was in Vishing campaigns targeting: Bank of the West (8442232936), Wells Fargo(3033339999), Chase (9702648968), UBS (8662889024), Bank of America (5173764159), Century Bank and Trust (3057049968), PNC (8008360477) with continuously changing numbers. Tech Support scammers also staged an Phishing innovation last week by turning to Twitter for finding new victims. During a 24h period starting Friday 2/27 8pm (PT) NUMBERCOP tracked suspicious reply-tweets promoting the same set of call back numbers (8448532662, 8554086991, 8554848417, 8556144600, 8665980235 across 650+ tweets). All tweets were in reply to computer related issues... 

Please contact us for access to our real-time Smishing & Vishing Threat feeds.

[numbercop]

Weekly summary 2/16-2/22

Quick update on what occurred on the Smishing/Vishing front last week. We tracked targeted attacks on Wells Fargo (multiple campaigns), Bank of America, Chase, US Bank and a rare guest: PNC Bank. 

Several of these originated from actual numbers (vs. Email2SMS gateways) for example 6149711012 which emitted both PNC's and Wells Fargo campaigns. On the inbound side scammers used again list-matching; blocking all return calls except for those numbers targeted on the outbound.

In parallel we also recorded several generic SMiShing campaigns esp. in MI - prompting alerts from Awakon FCU (MI), SageLink Credit Union (MI), Whitefish CU (MO), ASECU (CH), Seven Seventeen CU (OH).Texans Credit Union (TX) and Talmer Bank & Trust (OH, MI) were targeted in Vishing campaigns (via 9196926063, 3128944630).

Besides Royal Bank of Canada, no significant international campaigns this week, except a continuation of Bancolombia tagged fake sweepstakes (increasing number range). Somewhat surprising was the introduction of TD Bank's Text call center (cnnmon.ie/1DL4Wyk) - SMiShers will blend in just fine into this new traffic...

[numbercop]

Weekly summary 2/9-2/15

It's the President's Day long weekend and as expected we saw solid Vishing and Smishing traffic as most banks remain closed/lightly staffed today. Targeted attacks were recorded on Bank of America, Wells Fargo, Chase Bank, First American Bank (IO, IL), Achieve Card, Regions Bank, Suncoast CU (FL), Suncoast School FCU (FL) and Navy Federal Credit Union with additional alerts issued by Security Credit Union (MI) and Brightstar Credit Union (FL).

The Suncoast Smishing/Vishing (9th largest Credit Union in the nation) campaign was timed on a weekend during which the bank ran a major IT project with planned shut down of their websites/logins. Affected Smishing victims very unable to login - intentional or accidental, but perfect timing. One particular Suncoast CU Smishing message referenced a completely unrelated (?) Credit Union in Ireland (Mulcair Credit Union). 

Other internationally Smishing resumed in Canada targeting Royal Bank of Canada (Canada), Capital One (UK) and Metrobank (PH). RBC Smishers were somewhat in a rush; one incomplete sample unveiled a reference to "ePochta Mailer Email Template" which may suggest these messages traversed through a Russian SMS vendor.

[numbercop]

Weekly summary 2/2-2/8

Another active phone phishing week with targeted Smishing attacks on Bank of America, Chase, Huntington Bank (PA, OH, recording: bit.ly/1zLUy5w), Great Western Bank (SD), ClearView (PA),Auburn University Federal Credit Union (AL) and additional phone fraud alerts issued by Peoples Trust & Savings Bank and Sunmark FCU (NY). 

Abroad NUMBERCOP tracked continued Smishing activity targetingTD Bank, Bank of Montreal, Royal Bank of Canada and generic credit card Smishing in Sweden. 

Beyond the financial sector we reported on AT&T, T-Mobile (tmobile80[dot]com), Verizon and Apple iCloud account take over Vishing and Smishing campaigns. Hijacked phone accounts are a key piece within this criminal ecosystem, as well as contact information obtained from data breaches: Anthem, the nations 2nd biggest health insurer issued a phone scam alert only days after reporting 80 million customer records (incl. phone numbers) were been stolen. 

Also worth reading: Brian Krebs analysis of the recent Holiday Inn Smishing krebsonsecurity.com/2015/02/hacked-hotel-phones-fueled-bank-phishing-scams/

[numbercop]

Weekly summary 1/26-2/1

Typical week in Smishing and Vishing with attacks targeting Wells Fargo, Bank of America, Fed Choice FCU, Fifth Third Bank (TX), Susquehanna Bank (TX), NORTH Coast CU (WA), First Community Bank (AL). There was yet another HolidayInn Express Phone (TX) line getting hijacked for hosting malicious IVRs (Fifty Third Bank). Triangle Credit Union (NH), Great Western Bank (NE, news coverage), Texas Bank and Trust (TX), Dupaco Credit Union (IA) issued related phone fraud warnings. 

Significant Smishing traffic in Canada as well; targeting Bank of Montreal, Bank of Canada, TD Bank andRBC, continuing the trend of worsening Smishing activity as Canadian carriers fail to guard their text gateways from these attacks. 

Outside the banking sector we noted considerable uptick in traffic related to Craigslist, Kijiji, Gumtree text scams. Classified ads continue to be a lucrative source of victims to phone scammers. Meanwhile T-Mobile, Verizon and Sprint saw repeated account takeover campaigns which interestingly originated within network and are distributed via group messages.