In Ukraine, SMS attacks by fraudsters are becoming more frequent: message spoofing has become one of the most common schemes to deceive users in recent months, the support team of the cryptocurrency exchange Binance told Incrypted. According to the platform’s representatives, the team has recorded many requests with this problem.
«Despite the emergence of hundreds of modern authentication apps, SMS remains the primary way for millions of users to confirm transactions. Fraudsters have learnt to embed fake SMS in the same chats where you receive official messages from banks or exchanges. The same number. The same message thread. Completely different intentions», Binance notes.
Why it is dangerous
SMS spoofing is a technique where fraudsters send messages on behalf of someone else. The phone does not distinguish a real message from a fake one and combines everything into one branch. As a result, the user sees a fake SMS next to official messages — from a bank, mobile operator or online service — and believes it is genuine.
«Then everything goes according to the scenario: a call to the hotline, data entry, or money transfer», Binance says.
The whole scheme is based on psychology, the exchange team notes: create panic («your account is under attack»), add urgency («call immediately»), mix real and fake — and the user takes the necessary actions.
How it works
- Weak SMS gateways. Some providers allow you to change the sender’s ID.
- VoIP services. Internet telephony allows you to specify any sender’s name.
- Grey channels. Some bulk email providers cooperate with fraudsters and help embed fake messages in «trusted» channels.
True story: one of the exchange users received an SMS about «suspicious logins from different cities». The message appeared in the same thread as real messages from the exchange. In a panic, he called the specified number.
«Then the fraudsters played a subtle trick: they simultaneously initiated a real password reset request on Binance to confirm their ‘legend’. In the conversation, they offered to «protect the funds» and transfer them to a wallet to which they gave a seed phrase. In fact, it was their own wallet. If the victim had succumbed to the pressure, their money would have ended up with the fraudsters», Binance said.
Screenshots: Binance.
How to protect yourself
Watch out for «red flags»:
- calls to act immediately: «call now» or «confirm your details urgently»;
- SMS with suspicious links that do not lead to the official website;
- messages without your unique security token (code or user ID).
Follow simple rules:
- All actions — only in the application or on the official website. Any settings or operations with your account should be performed only through trusted channels. No «hotlines» from random SMS or links are safe.
- Check the Anti-Phishing Code. If you have installed it, it appears in every official message. If not, your User ID is automatically added to the SMS. If there is no token, it is a red flag.
- Don’t be in a hurry. Scammers play on urgency. Always pause and check the information through official channels.
- Education is the best weapon. The best way to counteract is to be informed. Follow cybersecurity news and read up on common scams to recognise a threat before it hits you.
«Technology cannot protect against everything. Even the best technical filters won’t stop fraudsters if the user gives them access. Therefore, knowledge and caution become the main shield. In the Web3 world, every minute counts: it only takes one fake SMS to lose everything. Don’t let fraudsters play on your trust. Set your own security rules and stick to them», Binance concluded.