Up to a few days ago, I always received Facebook auth tokens from numbers
+181338477XX, except a few times from
Problem is that lately I've been receiving codes directly from Italian numbers, which wouldn't be strange since I'm located in Italy, but there are two odd things:
1. they are much much slower than before, i.e. may take easily 2~15 minutes, while before they were instant
2. they are badly formatted, not exactly with spelling mistakes like the typical phishing mail, but oddly they add random characters in the text (examples follow)
Il tuo codice di sicurezza di Facebook: XXXXXX
Il,tuo codice'di sicurezza di Facebook: XXXXXX
Il tuo codice di,sicurezza_di Facebook: XXXXXX'
Il tuo codice,di sicurezza di Facebook: XXXXXX,
Il tuo,codice di sicurezza_di Facebook: XXXXXX.
Il,tuo codice,di sicurezza di Facebook: XXXXXX
edit for some new SMS:
Usa 033985'come_password per Facebook Messenger for.Android.
Usa 033985 come password'per Facebook Messenger for Android._
Usa 808589 come password per Facebook for Android.'
Usa 808589 come password per.Facebook for.Android.
(these are different because it's not the web login but the Android app logins, but still weird characters appear)
I have two phone numbers bound to that FB account. Previously I logged only the message of one of those phones. Now instead o logged them on both phones, and it is interesting to notice how even the "same" message was corrupted in different ways.
The first odd thing is those random characters (so far
.) either between two words or at the end of the string, and the second odd thing is that the phone numbers are always totally different, while before they were using only two "main" numbers, with many "sub" numbers (pardon the made-up terms).
I'm totally clueless about who could do such a thing such as hijacking
SMSs, why corrupt the messages this way, and why do that and not use it: i.e. looking at the logins, authorised devices, etc. there wasn't anything unusual.
A final oddity has happened the first time we received such a message: there are two phones bound for these auth tokens, and only one of those received the strange message, while the other one received the correct one (both were delayed, though).