Republished on June 21 with the latest FBI warnings for smartphone users.
A raft of news stories this week (1,2,3) report on the FBI warning 150 million Apple users to delete texts on their iPhones. Unfortunately the reality is even worse than those headlines suggest. Here’s what you need to know and what you should do.
Right now, your cell phone is vulnerable to an ongoing attack that will come to you by way of text messages warning of dire consequences if you don’t respond right away. Text messages that include links to pay outstanding bills or fines.
All of this is made up, of course, but you pay nonetheless because you’re worried — that’s the idea. These messages include unpaid tolls and newer DMV traffic offenses, but will soon widen the net to mimic texts from your bank or credit card company.
It’s against this backdrop that we have seen headlines urging America’s iPhone users to delete the latest raft of DMV texts as soon as they’re received. But that warning applies equally to iPhone and Android users — in this instance, iPhones aren’t special.
The malicious texts are sent courtesy of organized Chinese criminal gangs that operate beyond the reach of U.S. law enforcement. They harness countless phone numbers from multiple countries and domains from multiple providers.
Despite network filtering and iOS and Android spam detection, the tidal wave of texts seemingly can’t be stopped. Google has confirmed new AI-powered scam detection on its phones, and we await to see if this filters the threat or can be worked around.
The FBI’s warning to delete all these so-called smishing texts came in an advisory last year, issued in the wake of the original unpaid toll scam that has now swept across America from state to state. Any such texts, it said, should be deleted from phones.
There is no threat from texts left unopened or ignored on your phone. But knowing it’s from a cybercriminal’s number and contains a malicious link, the strong advice from the FBI and other agencies is to remove it from your phone.
But that applies to all smartphone users. There are some iPhone specifics — the OCGs prefer iMessage to SMS, albeit they like RCS as well, and the texts often include instructions to “Please reply with ‘Y’” to get around iPhone’s link blocking from unknown senders. But the the attack targets all users indiscriminately.
As I reported a week ago, the FBI has confirmed it is now investigating the latest plague of DMV-themed texts, which is unsurprising. The volume of those texts in particular surged almost 800% in the first week of June alone, and has not slowed down since.
A single bad actor armed with numbers and domains can send as many as “60,000,000 texts a per month, or 720,000,000 per year,” if that helps explain why there’s almost no one in America who hasn’t yet received these texts or knows someone who has.
The latest DMV scam warnings come from Florida, where “a fresh wave of text message scams targeting motorists is surging,” with “the FBI reporting a significant increase in these attacks, [which are] now more refined and convincing than in the past.”
Whether it’s an iPhone or an Android phone in your pocket, don’t leave these texts undeleted and never ever click on any of these links.
And while impersonating a DMV is bad enough, bear in mind that the FBI has also issued multiple warnings as cybercriminals actually impersonate its own agents, demanding payment for fines or missed court appearances to avoid arrest.
The most recent warning this weekend is the latest campaign messaging or even calling foreign students in the U.S., demanding a fee to continue uninterrupted. Yet again, scammers are impersonating law enforcement agencies in this atack, which has become a widespread theme across state and local as well as federal law enforcement.
The bureau’s advice in the latest attacks in Washington State could apply to all these attacks: “Scammers always prey on people’s fears. They’re always opportunistic.” And that opportunism pays off. ”They try to ratchet up that sense of urgency so that you don’t think about what you’re doing and then they just send the money.”
