103 Digital Life Security #7: Text Message Security — When a Message Isn’t What It Seems

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

Your phone vibrates.

You glance at the message:

Your package could not be delivered. Confirm your address now.

Or perhaps:

Fraud Alert: A $947 purchase was made from your account. Tap here if this wasn't you.

Maybe the message appears to come from someone you know:

I'm in trouble and need your help right away.

Text messages feel immediate and personal.

That is exactly what makes them useful to attackers.

Phishing Has a Texting Cousin

We have already discussed phishing: deceptive messages designed to convince us to reveal information or take an unsafe action.

When similar attacks arrive through SMS or other text messaging, they are often called smishing, a combination of SMS and phishing.

The technology changes.

The psychology does not.

Attackers still rely on urgency, fear, curiosity, authority, and familiarity.

The goal is usually to make you act before you stop to evaluate what is happening.

Why Text Messages Work So Well

Email has trained many of us to expect spam.

Text messages can feel different.

They arrive directly on a device we carry everywhere.

We often read them within seconds.

And because legitimate banks, doctors, delivery companies, stores, friends, family members, and authentication systems also communicate by text, a fraudulent message can appear among completely legitimate conversations.

That creates an ideal environment for social engineering.

The Package That Isn't Coming

Fake package-delivery messages are effective because so many people really are expecting packages.

A message may claim that:

• Your address is incomplete
• Postage is owed
• A delivery attempt failed
• Your package is being held
• You need to select a new delivery time

The message then provides a convenient link.

The fraudulent site may look like a familiar delivery company's website and ask for your address, password, or payment-card information.

Instead of following the link, go directly to the delivery company's website or application and enter the tracking number through a route you trust.

The Bank Alert

Another effective message says something frightening has happened to your money.

A purchase was made.

Your account was locked.

A transfer is pending.

Someone attempted to log in.

The natural reaction is:

I need to stop this immediately!

That emotional reaction is what the attacker wants.

Remember our rule from earlier in this series:

Urgency should slow you down.

Open your bank's application yourself, use the website address you normally use, or call the number printed on your card or statement.

Do not let the alarming message choose how you contact your bank.

Links Are Harder to Examine on a Phone

On a computer, we often have a large screen and may be able to inspect a link before opening it.

Phones provide less visual space.

Long web addresses may be shortened or difficult to examine.

Attackers benefit from this.

A page can also look remarkably convincing on a small screen because we see less of the browser interface and more of the imitation website.

This makes the trusted-route principle especially valuable on phones.

If you can reach the service independently, you often do not need the link at all.

Shortened Links Hide the Destination

URL-shortening services can turn a long address into a much shorter one.

There are many legitimate reasons for doing this.

But shortened links also hide the final destination from casual inspection.

An unexpected shortened link deserves additional caution, particularly when combined with urgency, payment requests, login requests, or requests for personal information.

QR Codes Are Links Too

A QR code can feel different from a link because we scan it with a camera rather than click it with a mouse.

From a security perspective, however, a QR code may simply be another way of directing you somewhere.

A malicious QR code can send you to a fraudulent website just as a malicious text link can.

This type of phishing is sometimes called quishing.

Before continuing after scanning a QR code, pay attention to the destination your device shows you.

A QR code should not receive automatic trust simply because it is printed on paper, displayed on a sign, or included in a message.

Verification Codes Are Temporary Keys

Suppose you receive a six-digit code from a service you use.

A few seconds later, someone contacts you:

We are verifying your account. Please tell me the code we just sent.

Stop.

That person may already know your username and password.

The code may be the final barrier preventing them from accessing your account.

A verification code is a temporary key.

Someone asking you to hand over that key should immediately get your attention.

Unexpected Codes Are Evidence

What if you receive a verification code when you were not trying to log in?

Do not automatically assume the worst, but do not ignore the information either.

Someone may have entered your phone number accidentally.

Or someone may be attempting to access your account.

Go directly to the service through a trusted route and review account activity if appropriate.

This returns us to an important principle:

Security is about evidence.

What If the Message Really Comes From a Friend?

A message from someone you know can still be fraudulent.

Their account may have been compromised.

Their phone number may be impersonated.

An attacker may be pretending to be that person from another number.

And increasingly sophisticated scams may include personal information gathered from social media, compromised accounts, public records, or previous data breaches.

If someone you know suddenly asks for money, gift cards, passwords, verification codes, or sensitive information, verify the request another way.

Call them using a number you already know.

A thirty-second conversation can defeat a carefully constructed impersonation attempt.

Family Verification Can Be Surprisingly Useful

Families can even agree on a simple way to verify unusual emergency requests.

It could be a question or piece of information that an outside caller would be unlikely to know.

This becomes increasingly useful as artificial intelligence makes it easier to imitate writing styles, generate convincing messages, and even imitate voices.

The technology may become more sophisticated.

Independent verification still works.

Can a Phone Number Be Faked?

Caller ID and message sender information should not automatically be treated as proof of identity.

Depending on the communications system involved, sender information can sometimes be spoofed or manipulated.

There are also attacks involving compromised accounts, forwarding, number transfers, or fraudulent control of a mobile account.

This means:

“It came from the right number” is useful context, but it should not be the only evidence used for a high-risk decision.

What Is a SIM-Swap Attack?

Your mobile telephone number is associated with service provided through your carrier.

In a SIM-swap or fraudulent number-transfer attack, an attacker attempts to convince or trick a carrier into moving a victim's mobile service to a SIM or device controlled by the attacker.

If successful, calls and SMS messages intended for the victim may begin arriving at the attacker's device.

This becomes especially serious when SMS messages are being used for password recovery or multifactor authentication.

The attacker may not need to steal your physical phone if they can gain control of the telephone number.

Your Mobile Carrier Account Matters

This is why the account you have with your mobile carrier deserves security attention too.

Use strong authentication for the carrier account.

Review any available account PIN, transfer protection, number lock, or similar safeguards offered by your carrier.

Your phone number may be connected to many other accounts, making the carrier account part of your larger security system.

SMS Was Not Originally Designed as a High-Security Messaging System

Traditional SMS is an old technology.

It was designed to transport short messages through mobile telephone networks, not to provide the kind of modern end-to-end encrypted communication we might design today.

Messages pass through telecommunications infrastructure, and traditional SMS does not provide end-to-end encryption between the two users.

This does not mean that every SMS message is being read by someone.

It means we should understand the security properties of the technology rather than assuming that all forms of messaging provide the same protection.

What Is End-to-End Encryption?

With properly implemented end-to-end encryption, a message is encrypted so that the intended endpoints possess the cryptographic capability needed to read its content.

The service transporting the message is designed not to possess the keys necessary to read the protected message content in transit.

This is different from a system where messages may be encrypted during portions of their journey but are accessible to intermediate systems.

This distinction is important:

Encryption in transit and end-to-end encryption are not necessarily the same thing.

Not Every Text-Looking Message Is SMS

Modern phones may display several different messaging technologies inside interfaces that all look like texting.

Depending on the devices, applications, and services involved, a conversation might use traditional SMS/MMS, RCS, or an internet-based messaging system with different security capabilities.

Some messaging services provide end-to-end encryption under certain conditions.

Others do not.

The important lesson is not to memorize every messaging protocol.

It is to recognize that the appearance of a conversation does not tell you everything about how the messages are being transported or protected.

Encryption Does Not Prove the Person Is Honest

Here is another distinction we have encountered before.

You can have a beautifully encrypted conversation with a criminal.

Encryption protects the communication channel.

It does not determine whether the person on the other end is trustworthy.

This is similar to HTTPS.

A secure connection to a fraudulent website is still a connection to a fraudulent website.

Secure communication and trustworthy identity are related problems, but they are not the same problem.

Be Careful With Attachments and Files

Messaging systems can deliver more than words.

They may include photographs, documents, contact cards, links, applications, and other files.

The same rule we used for email applies here:

Was I expecting this?

An unexpected file from a familiar person deserves attention, particularly if the message asks you to install software, enable something, log into an account, or bypass a security warning.

Do Not Reply Just to See What Happens

When an obviously suspicious message arrives, engaging with the sender is usually unnecessary.

Replying can confirm that the number reaches an active person and may invite additional interaction.

Use your phone or carrier's reporting and blocking features when appropriate, then move on.

Do Not Be Afraid to Delete

One of the simplest security tools is surprisingly powerful:

Delete.

You do not have to investigate every fake package notice.

You do not have to argue with every scammer.

You do not have to find out what is behind every suspicious link.

If you do not need the message, deleting it removes the temptation to interact with it later.

A Practical Text Message Security Checkup

Think about how you currently use text messaging.

• Would you recognize an unexpected verification code as a warning?
• Would you ever give a login code to someone who called or texted you?
• Do you use text messages to reset important accounts?
• Is your mobile carrier account strongly protected?
• Does your carrier offer additional number-transfer protection?
• Do you independently verify unusual requests for money?
• Do you inspect destinations before opening unexpected links?
• Do you treat QR codes as links rather than automatically trusted objects?
• Do you know which messaging technologies you commonly use?

We Are Separating Security Problems

This episode introduces another important skill for someone learning cybersecurity:

Separate different security questions instead of treating “secure” as one thing.

Was the communication encrypted?

Was it encrypted end to end?

Do we know who controls the account?

Do we know who currently possesses the phone?

Do we know who controls the telephone number?

Is the person communicating with us trustworthy?

Is the link taking us where we think it is?

Those are different questions.

Good security analysis identifies which question we are actually trying to answer.

The Message Is Only the Beginning

A text message may contain only a handful of words.

But behind those words are telephone networks, internet services, accounts, devices, authentication systems, encryption protocols, and human decisions.

The attacker often does not need to defeat all of that technology.

They may simply need us to press a link or hand over a code.

So when an unexpected message arrives, remember what we have been learning throughout Digital Life Security:

Slow down.

Use a trusted route.

Verify important requests independently.

Protect the accounts behind the technology.

And follow the evidence.

A message may be short. The security story behind it can be much larger.