2

A friend of mine had just had the following happen:

  1. He visited a website with the mobile phone using Chrome Mobile on Android
  2. An advertisment poped up that covered the whole page
  3. There was no close button, and while scrolling the ad, he might have clicked a button
  4. Immediately afterwards, he received an SMS from droidboost that he will be charged 4,99€ for an abo of droidboost.

Notice how there's only a single user interaction there, clicking the button. (Reportedly, he only scrolled, but I can't eleminate the possibility that he might have accidently clicked a button as well, since accidently taping on the touchscreen can happen easily)

My question is now, how can this be possible? Is it possible for a website to send an SMS or access the mobile phone number of the phone visiting this website, using JavaScript or similar? I would have thought that such an action was not possible through a mobile web brower.

I have already checked with http://headers.cloxy.net that the mobile device is not sending its phone number in the request headers either.

  • 1
    Right, this technique is called WAP billing. – Daniel Ruf Jan 1 '16 at 20:01
  • @AndréBorie It's not carriers' job to protect against clickjacking, unless they're holding back OS updates. That's generally a browser issue. – Someone Somewhere Mar 11 '16 at 10:26
  • @SomeoneSomewhere what I meant is that you shouldn't be able to pay just by clicking without having previously logged in or entered your payment information. An IP address shouldn't be a means of authentication, especially not when it comes to payments. – André Borie Mar 11 '16 at 11:31
  • When I set up carrier billing (through Google Play, don't know about other services) with 2Degrees NZ, I didn't need to use mobile data - it worked over WiFi. The Google Play app sent an SMS to 2Degrees; I'm assuming it had a one-time key to associate the Google account to the phone number. – Someone Somewhere Mar 11 '16 at 11:48
  • @SomeoneSomewhere if it's through an app I guess that limits the risk a bit, but this kind of billing should IMO never be done over the standard web (let's say you're using personal hotspot to share your mobile connection with someone, you don't want them to be able to buy things). – André Borie Mar 11 '16 at 13:26
4

It's called HTTP header enrichment. The MSISDN (mobile phone number) is injected in the header once the user hits a whitelisted URL by the operator. Not visible through http://headers.cloxy.net.

The surprise payment was made through something called clickjacking (google it for more info).

Basically your friend needs to complain to operator's customer support and the operator will do a chargeback (refund), Your friend might still be able to access the "Droidboost" service for a short while.

For some reason I guess that you're from Germany, so Vodafone, T-mobile, E+, O2 (whatever operator/carrier) will also probably ban the customer having access to their payment APIs. Hopefully they'll also impose a ban on where some the companies using their payment APIs are "buying traffic", ieg Google adwords.

@André Borie Jan 1 at 13:20 - The problem isn't the actual billing method, the problem is obviously which companies and services the operator grants access to their payment APIs. Previously the billing method was used by junk companies in the porn, ringtone and wallpaper genre. Now Google, Microsoft, Apple, Amazon, Spotify, Sony, LG, Samsung and more are rolling out global coverage in carrier/operator payment channels.

  • please do not make comments in your answer - you can comment on your own answer – schroeder Mar 10 '16 at 17:38
  • This also happened to me. I was browsing an ad-funded pdf sharing site, then a pop-up ad loaded. then I got an SMS saying "Thank you for registering for our program. First 3 weeks is free trial, but succeeding weeks will cost you money per week," or something like that. I clicked no button, just the ad loading, I even closed it quickly, before any images loaded. Is this also a responsibility of my mobile carrier? – Ray Lionfang May 23 '17 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.