Nearly fooled by fake TSB texts

Need a Username

I got a text message earlier about an attempted login from a new device and if it wasn’t me to click a link.

I admit I would have been caught out (someone pointed out it was obviously fake before I did anything) because it appeared in message thread with other genuine TSB messages for authentication codes for other transactions.

So how did these spammers get into that message thread? Is that something easily done? And should I report it to the TSB?

I did phone Open24 but they are easily busy on the phone for the last few weeks. Only chance I will get is first thing in the morning.

Jim2007

I have not heard of a financial institution sending a link to anything in at least five years, although admittedly I don’t work with Irish banks. But it has been considered poor security practice for a long time now and I’d be concerned about an institution that continues to do so as it facilitates the scam you describe.

The bottom line - never ever click on a link sent to you by a financial institution you do business with no matter how genuine it looks.

[Even benign links, including images, in messages can be used to verify that the account the message was sent to is valid and that can help the hackers]

The only emails I received now from my bank tells me there is a message waiting for me in my portal, no links, no images, just plain text.

coylemj

Jim, the OP realises that it's a fake message and an attempted scam. The issue he's highlighting is that it ended up in a mesage folder along with older, genuine messages from his bank. The same thing happened me a few weeks ago when I got an SMS purporting to be from Bank of Ireland. When I read it, it was in a folder under a genuine SMS that the bank sent a while ago so appeared to be genuine. I did not click the link.

It appears that scammers can phone you or send you an SMS message while they 'spoof' their identity and neither the regulator or the network operators are able to do anything about it.

Jim2007

https://www.boards.ie/discussion/comment/117826942#Comment_117826942

Of course they can and if you are willing to pay say a hundred dollars or so you'll find someone will to do it for you. Just because a message ends up in a particular folder should not in any way make you feel confident about it.

Need a Username

https://www.boards.ie/discussion/comment/117827175#Comment_117827175

I don’t think you actually read my post.

I know the blah blah about banks not using links, or whatever - but the fact that it was in a message thread with genuine TSB texts is what had me fooled and I would have been confident that it was genuine had I not had someone to point it out because I didn’t know that this could be done.

That is the point of the thread.

Need a Username

https://www.boards.ie/discussion/comment/117826942#Comment_117826942

Thank you.

Normally I would have ignored such messages and hope the “problem” would sort itself out. For some reason yesterday I momentarily felt I should do something about it.

Good thing I was in company.

I would be very interested to know how the spoofed their way in the message thread.

nullObjects

https://www.boards.ie/discussion/comment/117827435#Comment_117827435

I'm assuming you mean your phone puts messages from the same number in the same "folder" on your phone?

Sms is quite old, so from a technical perspective it's quite easy to pretend a text is coming from a different number. If the hacker knows what number these texts normally come from they can just set that number as the from number when writing a script that sounds out a bunch of text messages.

As the other poster mentioned above it's normally through the app you receive a notification now so that they can secure the communication a bit better. v

Think the advice is that you should always ring if in any doubt. I rang once thinking I was being foolish and turned out the initial contact wasn't from the bank at all, definitely better safe than sorry!

Alun

I wonder how they know what the number is that is being used to send these kinds of texts? On my phone, they appear with just a name, not a number, and there's no entry for them in my contacts, so the messaging app isn't picking up the name there. I also can't find any way to reveal what the number is, at least on my Android phone, so how do they do it?

cap.in.hand.

I also got a ptsb text message yesterday and I don't have a ptsb a/c.

Ger Roe

https://www.boards.ie/discussion/2058206576/nearly-fooled-by-fake-tsb-texts

OP - Certainly report it to TSB. I am not sure they can do anything about it, but they need to be informed of all security threats that their customers might have to face. It is in the interests of all bank customers to let the banks know that their customers are being targeted - if confidence in the banking IT sector fades, they might be more worried and look to do something about it.

The level of sophistication of the phone scammers is growing. I have now started to receive scam calls on a fairly low usage work phone, with the displayed incoming number matching the network and first four digits of our legit work batch of phone numbers.

I once complained to Comreg about consistent scam calls and after months of going through various hoops for them (logging calls numbers, times etc), I was told that the calls were originating outside of the state and there was nothing they could do about them. I then asked if they would bring up the issue of international based scam callers at future international regulator conventions, and I heard nothing back from them.

Obviously not their problem once there is a way of copping out of the issue.

iamwhoiam

https://www.boards.ie/discussion/comment/117827404#Comment_117827404

Thank you for the warning . Its is so easy now to be fooled and I will be aware of this .

Need a Username

https://www.boards.ie/discussion/comment/117827518#Comment_117827518

I did report it this morning.

Need a Username

https://www.boards.ie/discussion/comment/117827473#Comment_117827473

Yes it was grouped in with messages from authentication codes.

I don’t remember is I explained that to customer support. I will call again in the morning.

nullObjects

https://www.boards.ie/discussion/comment/117827815#Comment_117827815

Fair play to you, definitely easier for the bank to try to do something to secure this stuff if they are aware of it

drogon.

I have had this happen with BOI before too, scammers are getting good at spoofing numbers - Same thing happening with calls too, where scammers are spoofing numbers they don't have.

Text messages (SMS) in general are very insecure, it really is the technology that is outdate and insecure and nothing the bank or mobile provider can really do. If they block one thing, scammers will just find another way around it.

There is already something that is much secure, like RCS https://en.wikipedia.org/wiki/Rich_Communication_Services as with everything it will just take a while for carriers and device manufacturers to support it.

Wheety

I used to be able to send texts from my old Nokia N95 phone (I think it was that one) and make it look like it was from another number. I could put text or a number in the 'From' field. If I entered a phone number I knew and my 'victim' had it saved in their phone, then as far as their phone new it came from that person. It would show the name of the person as they had it saved and appear in the text chain.

I never did anything too nasty but did have some fun with that 😂

That must be around 15 years ago now and I could do it from my phone back then so it would be very easy for the scammers to do now.

Jim2007

SMS was never designed to be a public service. It was originally used by telecoms engineers as a working tool, until marketing heard about it....

nullObjects

Screenshot 2021-09-07 at 13.48.12.png

Think I got the same text today

If you wanted to protect yourself, depending on what device you use it's possible to blacklist the website shown in the image

(I didn't type out the domain on purpose in case someone clicked on it!)

SHOVELLER

TSB are fake. Worst bank ever.

Ever try calling them? Never ending waiting and seem surprised when you suggest they should have a call back option:

"I'll make a note of that and our manager will review at the end of the month".

The other option is to actually call into a branch but that is even more demoralising as the staff hanging around there dont know anything.

Ghastly thing is that there is no choice here.