2

Here is a sample SMS that usually I trust:

The sender is in a text format and there is an information saying the sender does not support replies.

When I tried to login, I received verification code from a different number:

Now, the sender is a normal phone number. I can even reply to the number. There is a few strange characters in the prefix. Also, there is a wrong spelling: "confirm you (should be your) number". This SMS raises my suspicion. While the activation code is working, how can I be sure if the SMS is really send by the provider and not by someone in-the-middle?

  • 4
    What would someone in the middle do? If they got the code from Uber, they would use it themselves, not pass it on to you. – schroeder Dec 15 '17 at 13:40
  • 1
    typically, you look up the phone number to see if it is registered to the company it is supposed to be from – schroeder Dec 15 '17 at 13:41
  • 2
    That spelling is definitely a red flag, but what perplexes me is that you said that the code works... It's not unusual for companies to use different phone numbers for different purposes though; Vodafone contacts me via text with three different phone numbers. – MoonRunestar Dec 15 '17 at 13:52
  • 1
    @schroeder: That will most likely not work, see my answer. I doubt that Uber has any numbers registered for this at all. – Martin Schröder Dec 16 '17 at 11:31
4

Yes. The use of SMS for 2FA is very price sensitive (it's a commodity market racing to the bottom). The use and registration of alphanumeric sender ids (like "UBER") costs money and time (you have to get the contracts). But if one just wants the content delivered to the handsets, one uses the lowest bidder for delivery who will in the end use some numbers (can be even throw-away burner phones) as the last hop to deliver the SMS to the handset.

The scrambling of the content can also be intentional: Of course the telcos want the customers to use their pricey services, so the try to detect and block traffic from cheap numbers. One way to get around theses blocks is subtly altering the content.

I work at an SMS aggregator who develops 2FA, delivers SMS for 2FA, uses SMS routes, and has heard of content scrambling.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.