Spam Text Messages: The New Wave of Digital Robocalls

With new government regulations making it harder for scammers to make spam calls, they have turned to a new medium. Spam text messages are on the rise – and they carry new risks that spam calls don’t. Learn why scammers are moving from calls to texts and what you can do to protect yourself. See Smishing is the New Spam with Giulia Porter for a complete transcript of the Easy Prey podcast episode. Giulia Porter started learning about scams when her mother fell for a tech support scam. She didn’t have a cybersecurity background – she just learned along the way. In 2017, she started working at TelTech. TelTech developed RoboKiller , an app that eliminates 99% of spam calls, and most recently TextKiller, which is designed to do the same for spam text messages. She is now a vice president, helping advance the vision of a world with spam calls (or spam texts). As phone technology moved from landlines to cell phones to smartphones and texting, scammers’ tactics have evolved. Scammers are smart, and they want to hit us where we are. In 2017, spam calls started getting really bad because of new caller ID spoofing technology. This technology let the caller change how they appeared on the recipient’s caller ID. It could even be added to auto-dialers, making it very easy for scammers to make thousands of calls from a spoofed caller ID. As a bonus, it was nearly impossible to trace a spoofed number back to the scammer. It’s important to remember that scammers are smart. They are following how we are communicating. This caller ID spoofing evolved to neighbor spoofing. Even if you haven’t heard the name, you’ve probably had it happen to you. In neighbor spoofing, a scammer calls you from a caller ID with the same three or six numbers the same as yours. The goal is to make you think you’re getting a call from your doctor, your mechanic, or someone else local who you might actually want to talk to. But around 2020, the scammers started to see less success with these spam calls. People stopped trusting unfamiliar phone numbers, even local ones. And government regulations like STIR/SHAKEN made changes to caller ID protocols that made them harder to spoof. Scammers needed a new tactic. And they quickly found one: Spam text messages. What Is STIR/SHAKEN? STIR/SHAKEN is a framework designed to help stop the spam problem. It’s not a silver bullet to stop spam calls altogether. Its goal is to help consumers trust the caller ID that their phone shows when it rings. It verifies the true origins of a phone number by requiring certain verifications. That verification information is sent to the phone call processor, who can then decide if the verifications look geinune or not. If you’ve ever gotten a call with the caller ID “Scam Likely” or if you use a spam call blocker, you’ve seen STIR/SHAKEN in action. Since STIR/SHAKEN has affected scammers’ abilities to spoof caller ID, they’ve moved into spam text messages to stay ahead. Spam text messages are on the rise. Americans received 87 billion spam texts in 2021 – an increase of 60% from 2020. This is a relatively new threat, and not a lot has been done about it yet. Most of the industry focus so far has been focused on spam calls, not texts. We’ve seen this explosion in spam texts … what that’s done is made consumers vulnerable to yet another threat. Not every text message you didn’t want to get is a spam text message. There was a recent Supreme Court case regarding legitimate text messages that the recipient didn’t want to receive. A man sued Facebook for sending him many texts that he did not opt in for. The Supreme Court ruled in Facebook’s favor. This ruling broadened the definition of auto-dialer and what kind of consent is needed for it. In the past, you needed to have explicit consent from someone for a call or text to be legal. Now, part of identifying spam text messages is sorting out actual spam texts from ones that are legitimate but unwanted. Like any scamming method, there are some common scams that pop up again and again in spam text messages. These are not the only ones out there, but be alert for them. Giulia first started monitoring spam text messages at RoboKiller and TextKiller in regards to COVID-19-related texts . There were many scams around PPE, with links leading to fake websites where people put in their credit card information to buy PPE that they would never receive. As the world has started to return to normal, those are becoming less prevalent. These kinds of scams did happen with robocalls, but now they are more common through spam text messages. In this scam, the scammer sends you a text message pretending to be a well-known and trusted brand. The text will claim to be from Chase Bank telling you to authenticate something, or pretend to be Amazon requesting you verify a purchase. The scammers’ goal is to get access to your money by imitating the brand enough for you to provide your credit card or bank account information. In 2022, there has been a large increase in people complaining about lewd or gross spam text messages. This kind of spam was not very common with spam calls, but it does happen with spam emails. Giulia is not entirely sure what is happening with these kinds of spam text messages, but she and the team at RoboKiller and TextKiller are working on figuring it out. Scammers want access to anything that might contain your personal information. Many spam text messages are just a new medium for common scams. They might text you pretending to be your bank and asking you to log in with this link, but the link goes to a fake site that collects your bank login information. Or they might attempt to get into your Gmail account. Many scams previously run through spam calls translate very well to spam text messages. If you answer a spam call and don’t give them any of your personal information, there’s only so much that can happen. You can hang up immediately and end the call. At the most, the spammers may mark your number as one where a real person answers and you may get more spam calls in the future. But with an app like RoboKiller , that’s not much of an issue. Spam text messages, though, have more risks. The main risk factor is URLs. Text messages can send you links that take you to sketchy websites. The website could reveal your IP address and cookies to the scammers, or even download malware to your device. The URLs in text messages – frankly, for consumers, is actually more scary [than spam calls]. Giulia knows she isn’t very precise when tapping things on her smartphone. Even though she knows she shouldn’t tap on links in text messages, she could tap on one accidentally and still be exposed to the same dangers. TextKiller tries to shut down all text messages with URLs to protect users from malicious spam text messages. There are a few things you can do to prevent spammers from getting their hands on your phone number, or to stop the spam calls and spam text messages you’re receiving. Here are a few of Giulia’s recommendations. In many ways, our phone numbers are similar to our Social Security numbers. But we don’t treat them that way. We happily give our phone numbers to a random website in exchange for a 10% discount code when we would never give our Social Security number for the same thing. To reduce the number of spam calls and spam text messages you get, start thinking of your phone number like it’s as private as your Social Security number. Some businesses do legitimately need to know it, but many don’t. And many companies won’t keep your data out of the hands of spammers. When Giulia first joined RoboKiller , she Googled her phone number. She found that she had accidentally left it public on Facebook for anyone to access. If you find your phone number available publicly on Google, you can change your profile privacy settings to hide it. On websites where you can’t change the settings, you can request Google to not index the page because it has your personally identifiable information. Google can’t change the page for you, but they can make sure it doesn’t show up in search results anymore. You can request your phone number be added to a Do Not Call (DNC) registry. This is a list of phone numbers that no one is allowed to call with unsolicited telemarketing pitches. Unfortunately, since scammers aren’t following the law anyway, it won’t reduce the scam calls and spam text messages. But it will reduce the number of telemarketing calls you receive. If you answer a spam call or respond to a spam text message, it tells the scammer on the other end that this number is a working number that gets to a real person. That makes you a target for even more spam. Spam text messages are particularly tricky. Many of them will say things like “Reply ‘STOP’ to be removed from this list.” It tries to make you think that texting back “STOP” will stop the spam, when all it does is make you a bigger target for spam. Spam text messages often send URLs or links for you to tap on. Tapping on unknown links carries many risks. It could take you to a fake site and try to convince you to make a “purchase” so they can steal your payment information, or it could download malware onto your device. Either way, don’t risk it. Just delete it. It’s really hard to know how many of those URLs include malware, but they definitely are not safe. Both free and paid versions of spam call blocking and spam text message blocking apps are out there. These apps have databases of millions, if not billions, of known scams. As soon as you sign up, you’re immediately protected from those scams reaching you. RoboKiller and TextKiller use AI and machine learning to stop obvious scams from reaching you even if they’re not in the scam database. Spam text messages are a relatively new technique for scammers. The future of spam calls has yet to be seen, but it definitely looks like they’re starting to migrate over to tech. We are also seeing more people fighting both the spam calls and spam text messages. It’s important to get the telecommunications industry to work towards a unified approach to eliminate scams. Brands are also starting to take on the problem, as brand impostor scams are hurting their reputations. Whether we can all come together to help protect consumers from these scams will affect whether or not we “win” against spam calls and spam text messages. The RoboKiller app is available on the iOS and Android app stores. It offers free and premium versions, as well as a 7-day free trial. You can also find RoboKiller on social media, or visit robokiller.com to learn more about their spam call and spam text blocking services.