Hong Kong banks take on SMS scammers

Great initiative. Hope they also create an open directory so recipients of SMS know the full name of the company behind cryptic SMS Headers.

In the blog post titled Variants Are Making Phishing Attacks More Lethal Than Ever in my company blog, I gave two examples of scams that worked by using misleading SMS Headers:

----------

... when you get a text, you need to look at the SMS Header and use your general knowledge / common sense to decipher who the sender of the message is e.g. “TM-HSBCIM? Ah it must be HSBC Bank”; “VK-GODDY must be Go Daddy”; and so on.

This works well – until it doesn’t.

BP-RTODPT is not RTO Department (DMV of India). This SMS Header belongs to a motor insurance company that uses the bait-and-switch dark pattern to sell you a policy that you don’t need.

Then there’s QP-ITDEPL, the header used by a scamster to send out texts about income tax refund. A poor sucker who got this SMS thought it was from the Income Tax Department, took the offer for refund to be genuine, clicked through the link, and lost INR 2.94 Lakhs ($3900) in the bargain.

----------

If only there was a directory, diligent users could have avoided falling victim to the scam by looking up the directory and realizing that the above two SMS Senders were not who they claimed to be.

I get the introduction of # symbol but, as far as I can make out, this feature would merely change the SMS Header from e.g. BP-RTODPT to #BP-RTODPT, which can still succeed at scamming the recipient of the SMS.