#phonefraud

Quick summary from NumberCop’s Smishing and Vishing research lab: Malicious phone phishing campaigns resumed at full speed over the last two weeks; our data confirmed targeted Smishing attacks for: Bank of America, Wells Fargo, Chase, PNC Bank (Recording here), DirectExpress, Western Union, Visa and up north Scotiabank, TD Bank and Royal Bank of Canada.

Meanwhile many Verizon, AT&T and T-Mobile customers experienced another spike in spammy SMS chat-bots driving traffic to adult sites combined with numerous account take over attempts. Things appeared to be more quiet in UK and Australia as law enforcement stroke 3 times in these markets recently.

Weekly sampling attached. Contact us for in real-time threat intelligence via NumberCop’s API.

Welcome back to your weekly summary from the Vishing and Smishing front. After several calm weeks we’ve seen campaigns resume on regular intensity, targeting Bank of America, Wells Fargo, Chase, PNC Bank, Palametto FCU (CO), Boing Employee Credit Unions (WA). 

Several campaigns went through 3 or more targets in 48h, which we haven’t seen for a while. On the Vishing side activity was rather soft targeting a smaller group of Capital One (8559683131), Bank of America (7188889961), CBC FCU (CA) (8887585316) and again Boing Employee Credit Union (WA). 

AT&T and Apple account take over Smishing resumed as well. Internationally, Smishing was detected in Canada where Scotiabank and Bank of Montreal became targets, as well as Westpac (Australia).

Weekly sampling below or real-time via NumberCop’s API. Contact us for details.

And another quick summary of last week's action on the Smishing and Vishing front in the Financial Sector. New Smishing activity was on the typical to low side with targeted campaigns for Bank of America, Wells Fargo (multiple campaigns), Chase, Bank of Montreal (Canada), Natwest (UK) and Barclays (UK), Vishing however continued to pick up. 

Two numbers were particularly active (8888931773, 8885030711) impersonating Suntrust (8888931773), EECU Credit Union (8885030711) and Texans Credit Union (8885030711). Recipients of these calls were informed about their Debit or Credit card accounts being blocked and prompted for their card credentials via IVR.

Finishing an atypical calm Smishing and Vishing week 4/14-4/20. Besides a few standard FI Smishing campaigns targeting Bank of America and Wells Fargo - NUMBERCOP tracked only a handful of additional targeted campaigns namely for Firth Third Bank and Omaha Mutual (NE). On the Vishing side M&T Bank area codes were hit again (consistently using caller ID 8774637786) and Barclays nation-wide (via 8664674713).

Internationally, Bank of Montreal (Canada) and Natwest (UK) were continued targets. We collected further details that Natwest's Smishing campaign uses a Spoofed Sender ID, (instead of a hijacked Sender ID as believed earlier) for sending out Smishing text messages. With Natwest now being targeted non-stop for 2nd months it becomes evident how hard it is for an affected brand to shut down and non-compliant SMS VAS in the UK.

Within the wider Smishing news we recommend to follow a few sessions at this years RSA Security Conference taking place in San Francisco this week. In particular Cathal Mc Daid's session on Smishing (details here, presentation attached) which should be largely in line with NUMBERCOP's Spam Research.

As always please find our weekly Smishing sampling below and on our API for further details.

Quick recap as we're wrapping up a another busy Smishing and Vishing week. Targeted attacks were recorded on Wells Fargo, Bank of America, PNC Bank (Recording: bit.ly/1GIMiY5), Fifth Third Bank, HarrisBank and once again Boeing Credit Union (Recording: bit.ly/1O1lzGF).

Looking abroad NUMBERCOP detected Smishing campaigns targeting Bank of Montreal (Canada), Natwest (UK), O2 (UK), British Telecom (UK), Tesco (UK) and Bancolombia (Colombia).

Back in the US renewed Vishing activity was tracked especially in the 2nd part of last week targeting M&T Bank, Barclay Card and again Boeing Credit Union. We also saw the re-emergence of SMS Chat bots, which have been notability absent since the beginning of the year.

Weekly sampling below or realtime via our API's.

Here comes your NUMBERCOP Smishing summary for last week; majority of activity targeted Wells Fargo, Bank of America, Chase (significant activity), Regions Bank, Fifth Third Bank (OH), Chief Financial CU (MI), Boeing Credit Union (WA), South Side Bank (TX), Education First FCU (TX) and numerous generic "(Card Blocked)" campaigns.

Particular attention was on Boing Credit Union last week. The 4th largest credit union, which a very strong footprint in the Seattle (WA) metro area, was targeted multiple times last week, first via Vishing robocalls, followed by 2 distinct Smishing text campaigns.

Meanwhile in the UK Natwest type smishing (via hijacked Sender IDs) expanded even further with targeted attacks on Santander, after Lloyds Bank as reported previously.

That last week in February saw some atypical but interesting Smishing & Vishing traffic. We recorded reduced weekend Smishing activity (weekends are usually prime-time) while voice based attacks increased significantly.

Targeted Smishing campaigns focused on the earlier part of the week: Bank of America, Wells Fargo, BB&T, Great Western Bank, Bank North West, US Bank plus a generic Smishing campaign triggered phone scam alerts were issued by Awakon FCU (MI), Wildfire CU (MI), Hastings City Bank (MI), Consumers CU (MI) and Village CU (IA). Text based account take-over attempts continued for AT&T, T-Mobile and Verizon. We also saw a new smishing campaign targeting UK's tax payers (HMRC).

Most action however was in Vishing campaigns targeting: Bank of the West (8442232936), Wells Fargo(3033339999), Chase (9702648968), UBS (8662889024), Bank of America (5173764159), Century Bank and Trust (3057049968), PNC (8008360477) with continuously changing numbers. Tech Support scammers also staged an Phishing innovation last week by turning to Twitter for finding new victims. During a 24h period starting Friday 2/27 8pm (PT) NUMBERCOP tracked suspicious reply-tweets promoting the same set of call back numbers (8448532662, 8554086991, 8554848417, 8556144600, 8665980235 across 650+ tweets). All tweets were in reply to computer related issues... 

Please contact us for access to our real-time Smishing & Vishing Threat feeds.