Text message scams, or smishing, are reportedly a central element of a global fraud operation valued in the billions. These scams are becoming more sophisticated and difficult for the public to identify.
Criminals can send out thousands of texts, with 98% of messages typically opened within 90 seconds. These messages often distribute scams related to unpaid parking fines, rescheduled deliveries, or tax rebates.
Clicking a link in a scam text can lead to fake payment sites that harvest card details or prompt the installation of malicious apps. Some bank impersonation scams are also said to begin with a fake delivery message.
The rise of 'fraud-as-a-service' allows individuals with low technical experience to acquire fraud tools, potentially enhanced by artificial intelligence. One such operation, 'Lighthouse', is estimated to have affected a million victims across over 120 countries.
Another toolkit, 'Magic Cat', reportedly traced to a Chinese developer, is thought to have harvested details from 884,000 payment cards globally in seven months. This software, available for a weekly licence fee, provides copycat website templates for brands like Evri and Royal Mail.
Scammers are increasingly using encrypted platforms such as iMessage and RCS because these messages are routed over the internet and are not filtered by mobile networks in transit. These platforms also offer advanced features like video files and high-quality images, which can make fake messages appear more legitimate.