Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A friend said her husband was sleeping on the couch, and she got a text that appeared to come from his phone, but he didn't send the text. Is this possible to do, and, how can she trace the origin?
The text that she got on her phone showed up on his text screen on his phone as well.
The origin of the text could be an application that has the privilege of sending SMS from the owner of the phone that it's running on and reading the phone's contacts. I suggest looking through applications on the phone in the systems menu and determining what the privileges allowed for each app is, especially newly downloaded or newly upgraded apps.
If you find an offending app with privileges that you don't want it to have, either uninstall it or revoke the privileges you don't want it to have and be more careful next time when installing outside applications on your mobile device. Always read the list of permissions that an app is requesting on installation AND when upgrading.
There are web-based services out there that allow someone to spoof the origin of SMS. Most of the time, they're used by legitimate businesses (e.g., a store) and they're faking the origin for a legitimate purpose. For example, you could get a text from the business whose name is "1-800-FLOWERS" and they could actually set the origin so that it appeared that you received an SMS from +1 800 356-9377. Or they could even make it appear that it came from "1-800-FLOWERS" or whatever. It didn't originate on a phone at all. A computer program sent it.
The other answers (an app on the phone) are far more likely. But my point is that we shouldn't think that SMS messages can only originate from an actual phone. There are lots of online services out there that let people write programs to send SMSes. Spammers use such programs a lot. But hackers or pranksters could use such a service to send fake messages that would appear to come from whomever. You, as a person who received an SMS, would have a hard time figuring out that it wasn't legit. While it can be figured out, you won't figure it out by looking at the receiver's phone.
There's not enough information presented to know for sure (you don't confirm for sure that the message came from a phone number instead of a cloud messaging account, what type of phone, etc.), but if they're both using Google Hangouts for messaging and both of them are signed into either's phone at the same time, or across other devices, all sorts of weird errors like this can happen.
Messages from the sender might appear instantly on their own phone but messages destined for the recipient will be received minutes or hours later.
Hangouts in particular has terrible sync across devices.
There are programs out there that can use a different phone number and it would never show up on their phone.
If a person is smart enough the inevitable can be done! Your job is to keep an eye on your phone and pc and if something seems strange then check it out, call your provider. But some of these programs cannot be visually be detected.
I'm not sure WHY some people are INTERPRETING the question at hand. IF I understand the question correctly IT IS NOT POSSIBLE...AT ALL!
Spoofing is possible but it WOULD NOT appear on the supposed senders phone as well as the intended target! IF it is on his phone, it came from his phone! The exception is with Apple. Then it could come from a computer but someone would HAVE TO KNOW his apple password. AND that could only be Apple to Apple phones...if it is not apple to apple then even that method could not happen.
IF it is on his phone, it likely had to be someone who PHYSICALLY has the phone...wrote and then sent that message. There is NO WAY around that.
I hope this helps
