Protect Your Holiday: Stop SMS Spoofers

1. GUIDE A Definitive Guide to Keeping SMS Spoofers from Ruining Your Holiday

2. Table of Contents Executive Summary 3 Introduction 4 What is SMS Spoofing? 5 How does SMS spoofing work? 6 Impact of SMS Spoofing During the Holidays 7 1. Financial loss 7 2. Security leaks 7 3. Duplicate identities 8 Three Ways SMS Spoofing is Misused 9 1. Information verification 9 2 Money transfers 9 3 Under company names 10 How can users protect themselves against SMS spoofing? 11 How does LoginRadius resolve all the SMS spoofing concerns? 12 Conclusion 13

3. Executive Summary SMS spoofing, while not new, has become increasingly popular in the post-pandemic world. This technology replaces a sender's identity with false alphanumeric information, such as fake names or phone numbers in a text message. This technology is prominently used to provide counterfeit discounts to unsuspecting customers for financial gain during the holiday season. Users may also pose as employers, CEOs, or managers to gain access to proprietary information about a business, their products, and projects; or assume a fake identity to access servers through a secure login. Therefore, appropriate security integration is important if a business wishes to avoid security breaches resulting from SMS spoofing. Integration of a CIAM helps businesses shield their data from spoofing attacks and maintain privacy. LoginRadius' range of identity authentication, user management, and data governance products allows enterprises to upgrade security measures. Its frictionless integration and 100% uptime ensure no security violations. © LoginRadius Inc. | Confidential Information 3

4. Introduction SMS spoofing may be a common problem today, but the idea of spoofing is old and dates back as early as 1271 when Sultan Baybars devised it. The Egyptian commander handed Krak des Chevaliers a forged letter instructing him to surrender. The knights surrendered, only to find that the letter was fake, allowing Baybars to win. Over the years, many people have used this idea to mislead others. And now, SMS spoofing is one of the most common fraud methods SMS spoofing is often used to gain access to private, proprietary information, and funds of an individual. Spoofers usually use the names of government agencies or popular local or international companies to obtain critical information. While spoofing occurs all year round, these malicious activities increase during the holiday seasons due to the relaxed atmosphere and lower security measures of various businesses and institutions. To prevent information misuse and increase data privacy, it is important to understand what SMS spoofing is and how it may affect you. © LoginRadius Inc. | Confidential Information 4

5. What is SMS Spoofing? SMS Spoofing is a simple technique that allows users to change a sender's information when dispatching a text message through the short message service (SMS). It allows the user to change the sender's ID (name) or phone number. For example, a fraudster can replace a number entirely with an institution such as Oxford University or the Ministry of Education. When a hostile number sends an SMS, the sender information will be that of the institution and not the original user's. While spoofing has legitimate and illegitimate uses, it is often used for the latter. It is most popularly used for marketing purposes, to sell products, target new consumers, and retarget buyers. It can also be used by pranksters to make jokes and by fraudsters to obtain personal information, including bank account numbers, credit card numbers, one-time passwords (OTPs), etc. The numbers often look legitimate, making the receiver believe the information displayed in the SMS is authentic and credible. SMS spoofing and phishing scams have increased by over 300% in the last quarter of 2020 and over 700% in the first two quarters of 2021. If these numbers indicate the emergence of a trend, then understanding SMS spoofing is all the more important. © LoginRadius Inc. | Confidential Information 5

6. How does SMS spoofing work? SMS spoofing is not a complicated, multi-step technique. A user simply needs access to manipulation tools. Currently, there are three different types of tools available: • Spoofing tools: Spoofing tools are available for purchase in many online stores or legitimate IT businesses. These may be proprietary products sold by businesses or generic products created as a byproduct to other services they provide. • Hacking tools: Ethical hacking tools like Kali Linux can also spoof SMS. This type of technology is often created for cyber forensics but can also be used for SMS spoofing. It is considerably more high- tech than the other two types of tools. • Online apps: These tools are available in both free and paid versions. In a paid version, users can create an account, complete the payment and start spoofing messages. Free versions often limit the number of spoof messages sent, while paid tools can be subscription-based or limit-based. A scamster can use the above tools or apps to manipulate the sender's information - usually the contact number and name. Once the manipulation is complete, the user can send out as many spoofing SMS’ as they require without any hindrance. Most SMS spoofing tools do not require a high-level understanding of technology. There is a little-to-none requirement for coding. Therefore, even a layman who understands how to use a computer or a mobile device can use the tools. However, the disadvantage of this software is the extreme user-friendliness of these apps and the availability of this technology to anyone with minimal negative consequences. Instead, the receiver often feels the impact of SMS spoofing. © LoginRadius Inc. | Confidential Information 6

7. Impact of SMS Spoofing During the Holidays SMS spoofing scams are approximately 275% more popular on Black Friday. Over 56% of people fall for discount scams initiated through SMS during major holiday festivals like Diwali, Christmas, and Thanksgiving. This has an impact on an average person as well as the business. 1. Financial loss One major impact faced by people who fall for spoofing scams is financial loss. During the holiday season, SMS announcing discounts are often sent in bulk. These SMS often do not contain links to original product sites, rather fraudulent sites that look authentic. People who complete purchases without verifying the website or the product's authenticity can lose up to several hundred or thousand dollars in one purchase. These scams also affect the original business and its brand identity The scam often disappoints users, who may opt to boycott the brand entirely to ensure the event doesn't occur again, or because they cannot hold the business responsible. In either case, the business may suffer hefty financial loss due to petty spoofing scams. 2. Security leaks Spoofing messages are sent to businesses/employees, asking for confirmation of login details, bank account details, or even project or product updates. The SMS spoofing technology allows any third party to pose as a manager and gain information from unsuspecting employees who are more than willing to confirm details for their manager. Unethical competitor businesses that use such technology can gain an edge in the market without much effort. © LoginRadius Inc. | Confidential Information 7

8. 3. Duplicate identities Identity theft is often caught when the fraudster cannot provide accurate information about the brand/business whose identity they are assuming. However, with SMS spoofing, the fraudster can ask the person seemingly innocent questions like "Remind me what the name of your first pet was?" by posing as an old friend. Gaining this information can help create more accurate duplicate identities. The user's answers, in turn, can be used for a variety of illegal operations. The victim then faces the repercussions These are only some ways SMS spoofing can affect a person or a business during the holiday season. The rampant use of this technology makes knowing a few of the illegal use cases all the more important © LoginRadius Inc. | Confidential Information 8

9. Three Ways SMS Spoofing is Misused 1. Information verification SMS spoofing is often used to verify user information. The fraudster usernames of reliable people, such as managers, friends, family members, banking institutions, businesses, or government institutions to access personal information. The messages often ask for verification from the user. It may be a verification of name, bank card numbers (credit or debit), phone numbers, one-time passwords (OTPs), etc. The malicious fraudster can then use the information illegally to access accounts on social media sites, company servers, or email accounts. 2. Money transfers SMS spoofing is used to confirm money transfers during the holiday season. It is one of the easier scams to fall prey to because transferring money among friends and families as gifts are common during this time of year. People may lend their close family members and friends credit cards or other banking details. Fraudsters can pose as individuals confirming private information for misuse. © LoginRadius Inc. | Confidential Information 9

10. 3. Under company names SMS spoofing scams under company names are usually related to the expiration of subscription plans or contracts. It is a common scam because many people and businesses renew personal and professional contracts before or after the holiday season, particularly between Christmas and New Year's Eve. These types of SMS may ask for confirmation of details or send links to new and fake contracts. Some SMS may also lead to third-party pages, which may automatically download a virus or capture cookies and other information from the device In many cases, a user can identify an SMS spoofing message easily. Users must be vigilant so they don't open these types of counterfeit messages. However, for a business, opening even one hostile message can affect the overall security measures of the servers. Given below are some common methods users can use to protect themselves. © LoginRadius Inc. | Confidential Information 10

11. How can users protect themselves against SMS spoofing? 5 Check for writing and grammar. Spoofing 1 Do not open web links in unfamiliar messages. messages often have poor grammar or Avoid opening links in unrecognized messages. spelling. It is a clear indication that they are It is also good practice to not open links in fake. On the other hand, it is also good practice messages of people who usually do not send to compare previous messages from the same you links via an SMS. person on other apps (for example, Whatsapp 2 Do not share proprietary information over or Facebook). You can use this to determine SMS. Don't share vital information with people, whether the writing, grammar, and tone of family, friends, managers, or colleagues over content are in line with what the person/ text messages who usually don't use SMS to business usually uses. contact you. If a link raises suspicion, you can 6 Understand the common types of scams. always offer to send the data on the company- Learning more about the common types of SMS approved email ID instead of the SMS. spoofing scams is important. Employers can 3 Verify offers presented in SMSs. Discounts, train their employees to detect common types refunds, or other financial transactions of scams in the industry and avoid them offered on SMSs should be cross-checked on 7 Integrate malware and encryption software. official websites before clicking on any links. Most mobile phones now provide an automatic More often than not, SMSs that provide 90% filtering service. However, it may also be discounts or unexpected transactions are SMS worthwhile to invest in simple anti-malware spoofs software and encryption software to do the 4 Do not provide any personal information. filtering. Avoid sharing any personal information, including your name, phone number, or email address, using SMS. If the SMS is from family or friends, users can verify the question by contacting the person through a different means, (for example, an email or a call). © LoginRadius Inc. | Confidential Information 11

12. How does LoginRadius resolve all the SMS spoofing concerns? With the LoginRadius consumer identity and access management solution, you can provide your customers with the safest and most secure digital experience during the holidays. Here are a few ways how: • Single sign-on (SSO): • Improved registration and login options: It allows consumers to access multiple The identity management platform allows accounts with a single set of credentials, consumers to register using magic Link via offering ease of authentication and a email, and OTP. This way, consumers need not frictionless omnichannel experience. remember passwords to log in anymore. • Multi-factor authentication (MFA): • 360-degree view of consumers: It offers multiple layers of authentication It offers a 360-degree view of consumer during the login process to ensure that the demographics, so you can plan your next right consumers log in. move based on their behavior and personal preferences while building better relationships. • Security compliance: LoginRadius adheres to international standards • Social login: like the E.U.'s GDPR and California's CCPA Social login allows consumers to authenticate Other certifications include PCI DSS, ISO with a social media account. It helps your 27001:2013, ISO 27017:2015, ISO/IEC 27018:2019, consumers skip the hassles of the registration U.S. Privacy Shield, NIST Cybersecurity and end up with a seamless consumer Framework, and more. onboarding. © LoginRadius Inc. | Confidential Information 12

13. Conclusion While SMS spoofing scams are rising by the day, businesses can still ensure security by incorporating smart solutions. Integration of the right security measures is the number one requirement for any business that wants to ensure their customers and employees don't fall for SMS spoofing scams. Constant vigilance will also enormously help. Businesses/Employers must educate customers and employees on the proper protocol and format the business follows when sending out an SMS. Increased awareness about a business' typical formats and security practices ensures employees don't fall for these scams when they are initiated If you're unsure how to improve your business' security standards, book a personalized demo with LoginRadius. As a company with in-depth information on customer logins processes, identity verification, and data privacy regulations, we can provide you with the appropriate security measures to ensure your customers aren't targets of SMS spoofing. © LoginRadius Inc. | Confidential Information 13

14. LoginRadius is a leading provider of cloud-based Customer Identity and Access Management solutions for mid-to-large sized companies. The LoginRadius solution serves over 3,000 businesses with a monthly reach of over 1 billion users worldwide. reach of over 1 billion users worldwide. LoginRadius is a leading provider of cloud-based Customer Identity and Access Management solutions for mid-to-large sized companies. The LoginRadius solution serves over 3,000 businesses with a monthly ©Copyright, LoginRadius Inc. All Rights Reserved. ©Copyright, LoginRadius Inc. All Rights Reserved.