A few weeks ago, I woke up to an early morning text message on my smartphone. It wasn’t my editor or a needy friend in a different time zone. It was a message from myself.
“Free Msg: Your bill is paid for March. Thanks, here’s a little gift for you,” the text from my own phone number read, pointing me to a web link.
In the last month I’ve received a handful of such texts. In online forums, many Verizon customers have reported the same experience.
It was clear to me what was going on. Scammers had used internet tools to manipulate phone networks to message me from a number they weren’t actually texting from. It was the same method that robocallers use to “spoof” phone calls to appear as though they are coming from someone legitimate, like a neighbor. Had I clicked on the web link, I most likely would have been asked for personal information like a credit card number, which a scammer could use for fraud.
Consumers have struggled with cellphone spam for years, primarily in the form of robocalls with scammers incessantly ringing to leave fraudulent messages about late payments for student loans, audits by the Internal Revenue Service and expired car warranties.
Only recently has mobile phone fraud shifted more toward texting, experts said. Spam texts from all sorts of phone numbers — and not just your own — are on the rise. In March, 11.6 billion scam messages were sent on American wireless networks, up 30 percent from February. That outpaced robocalls, which rose 20 percent in the same period, according to an analysis by Teltech, which makes anti-spam tools for phones.
Verizon confirmed that it was investigating the text issue. On Monday, it said it had fixed the problem. “We have blocked the source of the recent text messaging scheme in which bad actors were sending fraudulent text messages to Verizon customers which appeared to come from the recipient’s own number,” said Adria Tomaszewski, a Verizon spokeswoman.
Representatives for AT&T and T-Mobile said they had not seen the same problem. But text spam affects all wireless subscribers, and carriers now offer resources online for how people can protect themselves and report spam.
Text scams vary widely but often involve getting you to cough up your personal data with messages disguised as tracking updates for phony package deliveries, or information about health products and online banking. Their rise has been fueled partly by the fact that messages are so effortless to send, Teltech said. In addition, industrywide and government efforts to crack down on robocalls may be pushing scammers to move on to text messages.
“Scammers are always looking for the next big thing,” said Giulia Porter, a vice president at Teltech. “Spam texts are just increasing at a much more drastic rate than spam calls.”
Here’s what to look out for with text scams — and what you can do.
What spam text looks like
By far the most common text scam is the message impersonating a company that is offering a shipping update on a package, such as UPS, FedEx or Amazon, according to Teltech.
In the last week, I have received messages that said a Samsung TV — a big-ticket item meant to get my attention — could not be delivered. Another advertised an anti-aging skin cream. Another message touted the benefits of a product that cured brain fog.
Be on the lookout for these telltale signs of a fraudulent text:
-
Scam texts typically come from phone numbers that are 10 digits or longer. Authentic commercial entities generally send messages from four-, five- or six-digit numbers.
-
The message contains misspelled words that were intended to circumvent the wireless carriers’ spam filters.
-
The links in a scam text often look strange. Instead of a traditional web link composed of “www.websitename.com,” they are web links that contain sentences or phrases, like droppoundsketo.com. This practice, called URL masking, involves using a phony web link that directs you to a different web address that asks for your personal information.
How to protect yourself
First and foremost, never click on a link or file in a suspicious message.
Definitely don’t reply to such a message, either. Even typing “STOP” will indicate to a scammer that your phone number is active.
To report a scammy text, AT&T, Verizon and T-Mobile offer the same number to forward the messages to: 7726. After forwarding, the carrier asks for the phone number that the message came from.
If text spam is becoming overwhelming, spam-filtering apps like Teltech’s TextKiller are meant to help. The app, which blocks spam texts for $4 a month, scans messages coming from phone numbers that are not in your address book. If the text is detected as spam, it gets filtered into a folder labeled “Junk.”
TextKiller was thorough — perhaps too thorough. It successfully caught five spam messages in five days, but it also erroneously filtered two legitimate messages, including a response from Verizon thanking me for reporting spam and a message from an AT&T spokesman. So I wouldn’t recommend paying $4 a month for this app, which is available only for iPhones, unless spam texts have become truly unbearable for you.
Teltech said that false positives for messages marked as spam happened in rare cases, and that customers could share feedback to train TextKiller’s accuracy.
A more practical solution is to use free tools to minimize interruptions from spam texts. On iPhones, you can open the Settings app, tap messages and enable an option to “filter unknown senders.” That places messages from numbers that are not in your phone book into a separate messages folder. On Android phones, you can open the messages app, enter the spam messages settings and enable “block unknown senders.”
Finally, both iPhones and Android devices include the ability to open the settings of a message and block a specific number from contacting you.
Bottom line
There’s a moral to this story: We can help prevent spam from flooding our phones if we stop sharing our phone numbers with people we don’t fully trust. That includes the cashier at a retail store asking for our phone number to get a discount, or an app or a website asking for our digits when we sign up for an account. Who knows where our digits eventually end up after they reach the hands of marketers?
A better idea is for all of us to carry a second set of digits, which can be created with free internet calling apps like Google Voice, that we treat as a burner phone number.
That way, the next time a scammer tries to send you a text from yourself, it won’t come from your own number.
