Your phone number is more than just a way to contact you – scammers can use it to target you with malicious messages and even exploit it to gain access to your bank account or steal corporate data
Online scammers continue to rake in staggering profits from a wide variety of fraudulent schemes. In recent years, many such schemes have been orchestrated by criminal syndicates that run scam compounds in Southeast Asia, where trafficked individuals are coerced into executing elaborate ploys, such as pig butchering.
Apart from building fake online relationships, the tactics of many online fraudsters often involve creating scenarios that demand urgent action or rely on other ruses, including purported bank or PayPal account takeovers, devices compromised with malware, failed package deliveries, and even kidnapped relatives and other schemes leveraging artificial intelligence (AI).
At the heart of many online fraud schemes is phishing and other social engineering attacks. Their success lies largely in their low-cost/high-reward nature, scalability, ability to exploit human weaknesses, as well as the challenges of cross-border law enforcement. To top it off, it may take one successful “phish” to pay off the entire operation.
Let’s now look at how phone numbers fit into this, why they are, together with account login credentials, so valuable to scammers, and how they can be leveraged for malicious ends.
For starters, threat actors could target you with malware disguised as benign links or attachments that will, however, install spyware or other malware on your device or exfiltrate your personal data from it. Alternatively, they can send you messages that aim to trick you into surrendering your login credentials or other personal information on phishing websites.
For example, ESET Threat Report H1 2024 highlighted the proliferation of GoldPickaxe malware that in its iOS iteration employs a multistage social engineering scheme that persuades victims to install a Mobile Device Management profile, giving threat actors complete control over the victim’s phone.
Despite the rise of digital communication, phone calls and messages remain a trusted method for exchanging confidential information.
Why are all these scams such a threat? These days, many online services rely on phone numbers for authentication and account recovery. Compromising a phone number can, therefore, be tantamount to bypassing your security safeguards, including two-factor authentication (2FA). Additionally, scammers may impersonate you to defraud your contacts – or your employer.
These days, many employees use personal or company phones to check their corporate emails or messages. This creates a notable vector for attacks, as computers are no longer the sole access points for attempted compromise. Scammers could impersonate business executives or accounting departments to request money transfers for “business” purposes.
Indeed, the ultimate goal for many scammers is to gain access to corporate systems and funds. The human element plays a crucial role in these schemes, too. We often don’t verify the legitimacy of requests before complying with them, making it easy for phishing attacks to succeed and ultimately resulting in substantial financial damage to businesses.
For instance, imagine being an accountant at a large financial company. You’re playing around with Excel when you receive a phone call, seemingly from your boss, asking you to wire over money for a business deal whose success hinges on your prompt action. Such scams are quite real. Since the call appears to come from your boss’s number, you may not question its legitimacy – and you wouldn’t be alone.
The news runs red with mentions of this “CEO fraud”, a subset of business email compromise (BEC) fraud. Today, such scams are supercharged by AI, with threat actors using voice cloning to better impersonate someone (in case caller ID spoofing wasn’t enough).
So, what to do in such dangerous times?
Thankfully, there are a few ways people and businesses can stay free of phone scams:
To conclude, since a phone number can be a doorway for threat actors and lead to large-scale business compromise and millions in damage. It should be kept as private as possible – just like any other unique identifier, after all.
As phishing remains a major threat, stay vigilant and remember: validation and authentication are your keys to staying secure!