Smishing

Well, there is a big image below, visually more impactive than the pasted paragraph, that goes "Messages from bigger services #do not# display their numbers". Yes, but neither do scammers.

You are trying to discriminate legitimate entities L from impersonators L̅ through properties P, and especially define ways to identify L̅. You state that P(L), but that says nothing of L̅. And in fact, it is P(L̅) also - logical exhaustion.

Logically the sentence works, because it implies "If messages display their numbers, they are not from bigger services". But in terms of effectiveness in communication, if put in the context of "how to recognize a scammer", the original may be misleading - because there (see the picture) you are focusing on the alphanumeric, not on the number, and the alphanumeric is not a criterion - the number is.

The intention was to state "do not trust numbers". But in that context it is important to stress "do not trust alphanumericals either".

Generally speaking, there are short codes, and long codes. Sometimes alphanumerics are allowed, but the rules vary regionally.

Long codes resemble traditional phone numbers and tend to be treated as more disposable, low volume, and person-to-person. As such, they are typically easier to spoof with.

Short codes tend to be more like car license plates: short random/vanity codes that require a more in-depth process to get access to. They are easier to verify ownership, suited for higher volume messaging, and tend to be backed by automation systems that respond to a set of automated commands like "HELP". These qualities make them less likely to be used for nefarious purposes.

It's definitely a topic I'd love to understand more. Any corrections/additions are very much welcome!

And what do those which come from scammers look like? In some areas, they are identical to those from the «large companies».

George Carlin said "think of how stupid the average person is, then realize that half of them are stupider than that" https://www.youtube.com/watch?v=AKN1Q5SjbeI

The harried assistants and lower-level functionaries in those companies regularly field requests like "I'm in a sales meeting/airport terminal/Dunkin Donuts and need to demo something, and I need you do something stupid the wrong way".

So, it's a stupidity tax indeed, and even on the right people (CEO), but it's the assistants who get blamed and/or feel responsible.

Even at bigger and well-run companies, the assistants have stories that would shock you. CEO-speak can often tend toward illiterate and nonsensical, and their requests unreasonable -- even if they can be interpreted correctly. In contrast, COOs and CFOs are pretty reliable. And CTOs run the gamut, I'm sorry to say. :)

We had a sales woman fall for it. The email said from our CEO that said he was at a conference and needed her to go out and buy 10 $100 Visa gift cards and send him the numbers bc he wanted to use them as giveaways.

The issue is that our CEO actually WAS at a conference on that day!

She actually went to the closest CVS and bought them and thankfully mentioned something about it to me when she got back. I paused for a moment and then was like wait a second how did you hear about this request? Email only? so I called our CEO to confirm. Was able to go back to CVS and get them all refunded and the scammer got nothing.

But, that being said, I can see how people fall for it. Employee and user training and awareness are key to prevent these types of things.

If the prevailing thought is that you're stupid for falling for a scam, then the victim is less likely to share and inform, and then education does not spread. All it does is make them feel awful, which is not helpful and just even more hurtful.

I think we have to come at it from the angle of the scammers are tactical and that it's okay if you are a victim. It sucks, of course, but no blame necessary on the victim.

I know someone who got a similar message from her priest asking for gift cards. The scammer got a hold of the church directory and used that to send out messages. The person thought she was doing a favor for her priest and wanted to help; it is not her fault that the red flags weren't as strong as they should've been. Not everyone operates on suspicion mode.

I know another who was almost a victim of the the sobbing phone call: "Granpda, I'm in jail! Please send me bail. Also don't tell anyone!"

These types of scams target emotions and kindness. That's how these people operate in the real world. It's not that these people are stupid, it's more that they are unaware and not sensitive to the red flags.