SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as users, or the providers themselves, detect illegitimate SMS spoofing?

4 Answers 4


The best way to detect if the message was spoof or not is to check the message-center. Normally, a spoofed source will have the message-center shows different gateway from the network of the gateway where the originating source is.


Spoofed ID: VERIZON Message-centre: +927566004455

Original ID: VERIZON Message-centre: +181800001111

got it?

  • 4
    Is it correct that in order to find this information you would have to contact your network provider?
    – Chris Dale
    Commented Mar 11, 2013 at 7:57
  • I'm shocked to know that a suspicious sms that I received recently (containing OTP) is indeed using a different message-centre number. Your answer is very helpful. Commented Jan 16, 2018 at 2:49

From an end-user perspective it's often very hard or impossible to detect spoofed SMS.

This all depends on the configuration done by the various operators. As John mentioned, you might be able to tell it from the message-centre (SMSC addr), but again this is eg. changed in various routing scenarios and is not a secure source of information. As Karrax says, it's more about understanding the common types of SMS spoofs.

  • Also worth mentioning is eg. Symsofts "SMS Firewall" which can filter based on stuff from rules to limit the number of SMS per hour for a specific SMSC, to analysis of content and originating IMSI and MSISDN. Commented May 22, 2013 at 7:17

Typically there are some tell signs you can look for in SMS spoofed messages:

  • They come written in your non-native language (for non-english users)
  • They appear to be coming from someone stored in your contact-list. They do however not exist in your contact list; often illustrated by a grey name instead of a blue name which is clickable.
  • They require you to contact them back on phone or email, instead of actually replying to the SMS
  • They play you on something beneficial for you, urging you to overlook the warning signs above.

Example phising message follows. Try notice the tell signs:

sms phising

  • Yes, I believe this is a visual indicator, but there must be something from the data that can serve as a proof that the message was spoofed rather than just relying on the way it was constructed. Just like validating an email content, looking at the header is important as well.. Commented Sep 12, 2012 at 9:16
  • I would say that these are tell-tale signs for spam or phishing messages but not a list of ways to detect SMS spoofing. A text from a non-native english speaking friend saying they have a spare ticket for a concert and asking me to call them would tick 3 of the 4 :)
    – Andy Smith
    Commented Sep 27, 2012 at 13:17

The problem is the protocol does not involve identity validation. So the only way to be sure, is to do the same as we do with email. Sign them with GPG.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .