Scammers Exploit Data Breach Information for Simple Text Message Scams
Scammers are leveraging personal data from breaches to initiate conversations via text messages, using minimal information to elicit a response and begin social engineering tactics.
Cybercriminals are increasingly adept at exploiting information gleaned from data breaches to initiate contact with potential victims. A recent tactic involves sending deceptively simple text messages that use a victim's name to prompt a reply. This approach, while seemingly innocuous, serves as a crucial first step in a broader social engineering strategy designed to engage individuals and eventually lead them into fraudulent schemes.
The core of this scam lies in its minimalism. Unlike more overt phishing attempts that might include suspicious links or urgent warnings, these messages often consist of nothing more than a person's name followed by a question mark. This brevity is intentional, aiming to elicit an almost automatic response such as "Yes?" or "Who's this?" The Federal Trade Commission (FTC) has previously warned about such brief, seemingly harmless messages that serve as conversation starters for scammers.
By using the recipient's correct name, the message appears personalized and more compelling than a generic greeting. This personalization creates an illusion of familiarity, making the recipient more inclined to respond. While it's tempting to assume the sender must be someone known, having a name and phone number is not proof of a personal connection; such data is frequently traded on the dark web after breaches.
Once a reply is received, the scam can evolve in various ways, depending on the scammer's ultimate goal. Documented schemes show how an initial "wrong number" exchange can develop into a seemingly friendly conversation. Scammers focus on building rapport over time rather than immediately demanding money. This gradual approach makes victims more susceptible to later proposals.
Eventually, the conversation may steer towards an "investment opportunity." The FBI has detailed how cryptocurrency investment scams, for instance, rely on building trust before introducing fake investment platforms. Unsolicited text messages are identified as a common initial contact method for these types of scams, where victims are eventually encouraged to send money to fraudulent schemes.
Even if the conversation doesn't progress to financial loss, a simple reply can still be valuable to the scammer. As previously noted in analyses of "wrong-number" texts, a response indicates that the recipient is willing to engage. This confirmation makes the phone number more valuable, as it can be reused in future campaigns or sold to other malicious actors.
To protect against these types of scams, security experts advise against replying to unsolicited messages, even with a polite "Wrong number." If there's a suspicion that the message might be from someone known, it's recommended to contact that person through a verified, pre-existing channel. Before blocking a suspicious sender, users should utilize their messaging app's reporting feature.
Furthermore, individuals should take steps to limit their digital footprint. Reviewing privacy settings on social media and messaging apps to restrict visibility of personal information like profile photos, status updates, and phone numbers can make it harder for scammers to profile targets. Tools like Malwarebytes' Digital Footprint scan can help identify personal information exposed in data breaches, while scam number checkers can flag known fraudulent numbers, offering layered defenses against evolving text-based scams.