Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: AT&T Cell Phone Phish - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
AT&T Cell Phone Phish

Alan tells us that several AT&T cell subscribers have just received a text message, which instructs them to call a toll-free number XXX-XXX-7649 to resolve a problem with their account.  When called, a voice menu harvests their credit card information. 

An interesting delivery mechanism for an old-hat phish, which we're all used to seeing in our email inboxes - now bright-shiny-new as a text message - nice find Allan!

Johannes tested this with the 4111 1111 1111 test card number, which the phish menu verified correctly.  Subsequent tests indicate that a random 16 digit number is initially accepted by the voice menu, but fails verification at the end of the input process.  This indicates that the menu is actually verifying and processing the CC numbers correctly, and is most likely processing (evil) transactions in close to real-time.

Always interesting to keep tabs on what evil lurks out there !

Rob VandenBrink

519 Posts
ISC Handler
Over the last few weekends, we've had the same thing occur with most of the Nextel units in my company's fleet.

I've also spoken with someone in the local police department (also on Nextel) and they have been receiving the same messages.

There does seem to be a specific timing to the messages - I tend to receive them while driving home and again about 2 hours later, with Friday being especially common.

I wish they'd reset my debit card already. ;)
.JT.

1 Posts
I have had the same experience as Johannes. This was a T-Mobil scam and I entered a random 16 digit number which was checked and failed verification. How can we find the owners of he 8xx- telephone numbers we are calling?
Richard

4 Posts
You should be able to find the resporg for most 8xx numbers using the Ameritech Resporg ID service: 800-337-4194. It appears to be down at the moment, but I've had good luck with it in the past.

Getting the number deactivated can be an adventure, even though most telecomm companies will cooperate since this sort of thing is typically a TOS violation. Some of them can be a bit slow, though.
Richard
4 Posts
You should be able to find the resporg for most 8xx numbers using the Ameritech Resporg ID service: 800-337-4194. It appears to be down at the moment, but I've had good luck with it in the past.

Getting the number deactivated can be an adventure, even though most telecomm companies will cooperate since this sort of thing is typically a TOS violation. Some of them can be a bit slow, though.
Richard
4 Posts
Jim, thank you for the information. Let the adventure begin. I will post my results on here.
Richard

4 Posts

Sign Up for Free or Log In to start participating in the conversation!