The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email.

The Issue
Recently one of our users contacted us about a suspicious SMS he received that had the contant of an SMS message from three years ago. The only difference was that there was an obvious phishing attempt added to the end of the message. We checked our server logs and message audit log and our system did not have any record of the offending message.

We are trying to be vigilant and follow up on this issue. Our current questions are:

  1. How can we know whether this is a SMS spoof attempt that originated from our end or the user's end?

  2. How can we inspect the metadata of an SMS message? Is it safe to even forward that SMS message to another email for further investigation?

  3. Is anyone familiar of similar SMS spoofing attempts involving old SMS alerts?

  • So you use an SMTP2SMS gateway and one of your customers complained? Have you contacted the provider of the gateway? – Martin Schröder May 31 '18 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.