3

Recently I clicked an ad by mistake on my phone and it routed me through different pages and popups automatically. On of the pages had my mobile phone provider in its URL and WAP-billing. So I searched for WAP-billing but only found vague informations.

What are the dangers of WAP-billing?

Can it automatically (without my interaction or similar like in this case) withdraw money via my mobile phone bill?

Can it be used to identify me(get my name/address/mobile phone number/other ID)?

My provider automatically logs you in on his website without requiring any username or password if you open its website from your connection (most propably checking the source IP address and checking to which customer it is assigned to).

Improve this question
2
  • There have been WAP billing scams that have billed people without interaction.
    – Neil Smithline
    Sep 8, 2015 at 22:23
  • @NeilSmithline very good finding. It answers most of my question. I find it scary that such an easy exploitable security hole is provided by the carriers but it seems many companies would even sell their soul for earning more money.
    – skeptic75
    Sep 9, 2015 at 9:19

1 Answer 1

Reset to default
3

The dangers of WAP-billing include:

  • Highlevel of difficulty to stop or recoup unintended payments once initiated.
  • Susceptibility to clickjacking attacks through poorly or maliciously designed mobile web pages and applications.

WAP-billing will automatically add a line item to your mobile bill once you have confirmed the transaction (click). If you pay your bill automatically - it can certainly lead to automatic debits through your mobile provider. Disputing these charges with your mobile provider can be quite difficult because your mobile provider provides the initial payment on your behalf and then passes the charge along to you via your bill.

The information transmitted during each transaction will vary based on the payment gateway used and in some instances does include the mobile number. However, There seems to be geographic restrictions for the inclusion of this information based on a review of WAP-billing payment gateway service offerings. Since the payment is coming directly from your mobile provider there is no reason for any additional information (name, address, etc) beyond what is gathered when you land on the mobile site to begin with to be included in the transaction details.

Improve this answer
3
  • So without me doing a click on it, nothing could happen? They could have used the ad to load the WAP-billing site so that it generates a transaction as soon as I click anywhere through clickjacking?
    – skeptic75
    Sep 8, 2015 at 22:19
  • Trust but verify... Check to see that no charge was generated.
    – Fiasco Labs
    Sep 9, 2015 at 1:10
  • Is there anything I can do to prevent this in future? I dont use this feature and I dont want to give fishy people the chance to bill me (disputing a bill is exhausting) or get my phone number.
    – skeptic75
    Sep 9, 2015 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .