Hacker News Reader

Comment by mdp2021 | Hacker News Reader

mdp2021

To the puzzled: 'Smishing' = 'SMS' ∩ 'phishing'

> Signs that you are getting "Smished": [...] when you receive a message from bigger service providers, (f.e. banks, post offices, or delivery services) they will mostly have their company names displayed instead of their numbers

The formulation in the article may lead to a very bad advice: in some areas, scammers do display a "company name", regularly. So: a numeric sender string increases the chances of the SMS being a scam; an alphanumeric sender string /does not/ decrease the chances of the SMS being a scam.

View on HN

This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes.

The elephant in the room here is that SMS is not a medium where integrity or authenticity of a message can be guaranteed—which is one of the big reasons it’s such a popular medium for phishing.

Me thinks your gut is leading you correctly.

Generally speaking, there are short codes, and long codes. Sometimes alphanumerics are allowed, but the rules vary regionally.

Long codes resemble traditional phone numbers and tend to be treated as more disposable, low volume, and person-to-person. As such, they are typically easier to spoof with.

Short codes tend to be more like car license plates: short random/vanity codes that require a more in-depth process to get access to. They are easier to verify ownership, suited for higher volume messaging, and tend to be backed by automation systems that respond to a set of automated commands like "HELP". These qualities make them less likely to be used for nefarious purposes.

It's definitely a topic I'd love to understand more. Any corrections/additions are very much welcome!

> This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes

And what do those which come from scammers look like? In some areas, they are identical to those from the «large companies».

I believe we’re making the same point from different angles:

I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity.

You (correct me if I’m wrong) are stating that bad actors will craft messages that look like legitimate ones.

In either case, we end up in a place where I would be unable to determine if a message is legitimate barring further out of band confirmation.

> The formulation in the article may lead to a very bad advice: in some areas, scammers do display a "company name", regularly. So: a numeric sender string increases the chances of the SMS being a scam; an alphanumeric sender string /does not/ decrease the chances of the SMS being a scam.

Just curious, which part of the text did you understand this way?

If I would guess it could be with this part:

> The number of the sender and that of the service provider they claim to be, do not match. Moreover, when you receive a message from bigger service providers, (f.e. banks, post offices, or delivery services) they will mostly have their company names displayed instead of their numbers.

As I understand it, the article suggests that you still should compare the numbers even if only a name is displayed? But yeah your explanation is still on point.

> which part of the text

Well, there is a big image below, visually more impactive than the pasted paragraph, that goes "Messages from bigger services #do not# display their numbers". Yes, but neither do scammers.

You are trying to discriminate legitimate entities L from impersonators L̅ through properties P, and especially define ways to identify L̅. You state that P(L), but that says nothing of L̅. And in fact, it is P(L̅) also - logical exhaustion.

Logically the sentence works, because it implies "If messages display their numbers, they are not from bigger services". But in terms of effectiveness in communication, if put in the context of "how to recognize a scammer", the original may be misleading - because there (see the picture) you are focusing on the alphanumeric, not on the number, and the alphanumeric is not a criterion - the number is.

The intention was to state "do not trust numbers". But in that context it is important to stress "do not trust alphanumericals either".

I always wondered how that worked. How does Apple knows to display a company name instead of the "small numbers that are not actual phone numbers" (IIRC they are called Large Accounts)?

Nothing to do with Apple or software. The GSM protocol and upwards support alphanumeric SMS originators.

Thanks for the feedback. That's true it is not a single one indication.

Reply on news.ycombinator.com