Warning: Deceptive text messages

Digitalization brings both opportunities and challenges for society—and criminals are finding digital ways to reach us, too. They contact us by email, but increasingly through text messages or short messages in messaging apps. Our tips can help you stay protected.

Harmful text messages often look as though they were sent by a well-known company. For example, a delivery service may announce a package by text, or a mobile provider may claim to be offering bonus minutes. We should be suspicious, because the sender may be a mobile number we do not recognize at all. Clicking the link in the message can cause harm. 

How the SMS scam works

In so-called smishing (a combination of SMS and phishing), criminals count on consumers unknowingly sharing their login credentials or downloading malware. These criminal text messages can take many different forms. 

• The message includes a link that the recipient is meant to click for more information. However, it leads either to a manipulated website or to the download of malware.
• Contrary to the widespread belief that people with an Apple phone are automatically protected in this situation, they should also be very cautious. While malware used by criminals cannot take hold on their phones, criminals may still try to phish their Apple ID and password.
• People using an Android smartphone that is not optimally configured are more vulnerable. Clicking the link sent to them can set a chain of events in motion. Malware is downloaded and installed on the phone. The malware families that were especially active in 2021 aim, among other things, to spread widely. As a result, the contacts in the address book initially receive these types of text messages as well.
• Depending on your mobile plan, this alone could theoretically incur charges. The software can then download a banking Trojan, launch an extortion attempt, or cause additional charges through premium services. 

If you're wondering how scammers got your number, there can unfortunately be many reasons. Your contact details may have been collected from a hacked forum, an online retailer with a data breach, or social media. Someone who had your phone number saved on their mobile phone may already have fallen victim to a scam. Or criminals may have used a program that automatically generates numbers and contacted you at random. For all these reasons, it's always worth thinking carefully about which information you share and where.

How to protect yourself from fraudulent SMS messages

In general, this nasty scam only works if you take action. As long as you don’t respond to the message, nothing will happen. Just delete it. By the way, receiving an SMS itself is free. Why doesn’t the telecommunications industry simply filter out these types of messages? In Germany, the content of SMS messages is protected by telecommunications law, unlike the content of emails, for example. This means the content may not be analyzed and therefore cannot simply be filtered out.

• Be wary if you receive an SMS from an unknown sender or an unfamiliar phone number. This also applies if the message is very generic and tries to get you to do something without addressing you personally.
• Don’t let urgent-sounding messages persuade you to call back or click links. Take a moment to think it over. If you know the supposed sender, ask them whether the SMS is genuine.
• Only share your mobile phone number when it is truly necessary. 
• Don’t tap links in text messages, including messages from people you know. Their contact list may have been compromised.
• Install a security app on your smartphone and check your device regularly.
• Keep an eye on your phone bill or mobile plan budget so you can spot unusual charges early.

If your phone is infected, first switch it to airplane mode. This cuts off its connection to the malware’s command-and-control system. Then manually back up any photos, information, and contacts you urgently need to keep. Next, reset your phone to its factory settings. This also removes the malware.

As a preventive measure on Android smartphones: Disable the “Allow software installation from an unknown source/origin” setting.