3

Here is a sample SMS that usually I trust:

The sender is in a text format and there is an information saying the sender does not support replies.

When I tried to login, I received verification code from a different number:

Now, the sender is a normal phone number. I can even reply to the number. There is a few strange characters in the prefix. Also, there is a wrong spelling: "confirm you (should be your) number". This SMS raises my suspicion. While the activation code is working, how can I be sure if the SMS is really send by the provider and not by someone in-the-middle?

Improve this question
4
  • 4
    What would someone in the middle do? If they got the code from Uber, they would use it themselves, not pass it on to you.
    – schroeder ♦
    Dec 15, 2017 at 13:40
  • 1
    typically, you look up the phone number to see if it is registered to the company it is supposed to be from
    – schroeder ♦
    Dec 15, 2017 at 13:41
  • 2
    That spelling is definitely a red flag, but what perplexes me is that you said that the code works... It's not unusual for companies to use different phone numbers for different purposes though; Vodafone contacts me via text with three different phone numbers.
    – user84120
    Dec 15, 2017 at 13:52
  • 1
    @schroeder: That will most likely not work, see my answer. I doubt that Uber has any numbers registered for this at all.
    – Martin Schröder
    Dec 16, 2017 at 11:31

1 Answer 1

Reset to default
4

Yes. The use of SMS for 2FA is very price sensitive (it's a commodity market racing to the bottom). The use and registration of alphanumeric sender ids (like "UBER") costs money and time (you have to get the contracts). But if one just wants the content delivered to the handsets, one uses the lowest bidder for delivery who will in the end use some numbers (can be even throw-away burner phones) as the last hop to deliver the SMS to the handset.

The scrambling of the content can also be intentional: Of course the telcos want the customers to use their pricey services, so the try to detect and block traffic from cheap numbers. One way to get around theses blocks is subtly altering the content.

I work at an SMS aggregator who develops 2FA, delivers SMS for 2FA, uses SMS routes, and has heard of content scrambling.

Improve this answer
1
  • I'd like to create a canonical Q&A around SMS and 2FA since we're getting a bunch of questions about 2FA from strange numbers and poor formatting. They look they might be a form of what you describe. Would you be willing to help craft and answer a canonical post?
    – schroeder ♦
    Mar 12, 2021 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .