Single button click mobile direct carrier billing fraud

Question

A friend of mine had just had the following happen:

1. He visited a website with the mobile phone using Chrome Mobile on Android
2. An advertisment poped up that covered the whole page
3. There was no close button, and while scrolling the ad, he might have clicked a button
4. Immediately afterwards, he received an SMS from droidboost that he will be charged 4,99€ for an abo of droidboost.

Notice how there's only a single user interaction there, clicking the button. (Reportedly, he only scrolled, but I can't eleminate the possibility that he might have accidently clicked a button as well, since accidently taping on the touchscreen can happen easily)

My question is now, how can this be possible? Is it possible for a website to send an SMS or access the mobile phone number of the phone visiting this website, using JavaScript or similar? I would have thought that such an action was not possible through a mobile web brower.

I have already checked with http://headers.cloxy.net that the mobile device is not sending its phone number in the request headers either.

Answer 1

It's called HTTP header enrichment. The MSISDN (mobile phone number) is injected in the header once the user hits a whitelisted URL by the operator. Not visible through http://headers.cloxy.net.

The surprise payment was made through something called clickjacking (google it for more info).

Basically your friend needs to complain to operator's customer support and the operator will do a chargeback (refund), Your friend might still be able to access the "Droidboost" service for a short while.

For some reason I guess that you're from Germany, so Vodafone, T-mobile, E+, O2 (whatever operator/carrier) will also probably ban the customer having access to their payment APIs. Hopefully they'll also impose a ban on where some the companies using their payment APIs are "buying traffic", ieg Google adwords.

@André Borie Jan 1 at 13:20 - The problem isn't the actual billing method, the problem is obviously which companies and services the operator grants access to their payment APIs. Previously the billing method was used by junk companies in the porn, ringtone and wallpaper genre. Now Google, Microsoft, Apple, Amazon, Spotify, Sony, LG, Samsung and more are rolling out global coverage in carrier/operator payment channels.