Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [sms]

Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
0 votes
1 answer
76 views

Detecting SMS spoofing when there is multiple routing

How can SMS spoofing be detected? I know we can find it by message centre, but what if in the case of multiple routing?
Gayatri Kandula's user avatar
0 votes
0 answers
159 views

If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]

Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
Bob Ortiz's user avatar
  • 6,665
0 votes
1 answer
379 views

Would a spoofed SMS message show up in the same chat history as a legitimate SMS?

I received an odd SMS message from xfinity earlier. The message looks real, and the link they provided is real, but they said I ordered a movie through their service, which I did not. I am wondering ...
Zaku's user avatar
  • 101
0 votes
0 answers
145 views

Is ISP sending WiFi password in plain text to phone necessarily a bad sign?

The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
insecure's user avatar
0 votes
1 answer
2k views

SMS spoofing in the US

Long story short(ish), I have a friend who's been in a relationship with this girl for a while. When they started she had just moved across country and was in something open with some other dude. She ...
Arkyris's user avatar
0 votes
0 answers
28 views

Is it possible to trace a virtual number back to its service provider? [duplicate]

If a virtual number is only used to send and recieve messages, is it possible for somebody who know the number to trace it back to its service provider and somehow seize the number? (perhaps buying ...
Nuwanda's user avatar
  • 101
0 votes
0 answers
391 views

Every time I log into Facebook, the SMS based 2FA code appears to get intercepted (UK)

Historically, whenever I logged in I got a standard looking text from "Facebook" stating my login code. As of this morning, when I attempt to log in, I get a fake looking text from a random ...
ReflexReaction's user avatar
1 vote
0 answers
210 views

I'm receiving text messages that my family didn't send

Lately I've been receiving text messages from family members that they did not send. All 4 family members and I are a part of the SMS group where we send and receive messages related to our family. ...
MRPA67's user avatar
  • 11
0 votes
0 answers
38 views

I clicked on a SMS spam link. Am I safe? [duplicate]

I received an SMS from an unknown number with a link. Having just ordered stuff from AliExpress bit earlier so, thinking it was related to that, I clicked without doing due diligence. My bad. I went ...
bracco23's user avatar
  • 123
1 vote
0 answers
231 views

How spammers are abusing 2fa SMS in web apps?

My webapp has an SMS 2FA option. When someone enrolls, it sends an SMS to the number specified by the user with hard coded text that contains a token that the user needs to then enter in the web app ...
Michael's user avatar
  • 223
0 votes
1 answer
144 views

Why can't SMS be read online?

I am looking for a technical explanation from a security standpoint why SMS is, seemingly by principle, made impossible to read online whereas it looks it should be easily implemented. I have recently ...
amphibient's user avatar
3 votes
2 answers
288 views

Is asking users to enrol in SMS 2FA when they already have an authenticator good security practise?

I already have an authenticator for Amazon AWS, and I'm being regularly asked to add an SMS 2FA as well. If I add SMS MFA, will I become vulnerable to sim-swapping attacks on that MFA? Same thing with ...
Wadih M.'s user avatar
  • 1,132
5 votes
1 answer
538 views

Why is email 2FA not common?

SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
Someone's user avatar
  • 169
0 votes
1 answer
101 views

Using another's text number to commit ongoing fraud [duplicate]

Some Vietnamese refugee families have been Bitcoin defrauded by someone using an 805 text number. Lookups say it belongs to a party in Tennessee. I want to know if it is possible that scammers in ...
Hugh Giblin's user avatar
1 vote
2 answers
293 views

Is an attacker living close by able to identify my name and spoof my phone number by intercepting SMS messages?

As I read here and there, it seems like SMS isn't encrypted. Let's say I live in an appartment building. If someone uses a cellular modem to intercept my SMS messages, can they determine my name from ...
user123's user avatar
  • 111
0 votes
1 answer
110 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
david_adler's user avatar
0 votes
0 answers
128 views

Would removing a SIM disable the phone number and block text scams

I have a PAYG basic Nokia mobile, not a smartphone, and have noticed on my EE A/c there is a transaction for a Text Service with a charge of 15p, appearing every so often, which is nothing to do with ...
user avatar
2 votes
0 answers
122 views

Receiving phishing text messages

I get a phishing messages on SMS every now and then. I'm not sure if it's from anyone that knows me. What information can I get about the sender of the SMS?
Elec Hill's user avatar
0 votes
1 answer
309 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
low78's user avatar
  • 3
-1 votes
1 answer
232 views

Is a 2fa app really better than SMS 2fa with sim-pin?

A sim-pin safeguards against sim-swapping, which is the primary advantage of using an authenticator app instead of SMS, is this not so?
Ganon's user avatar
  • 9
0 votes
2 answers
868 views

How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?

Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
Bhavya Joshi's user avatar
1 vote
2 answers
300 views

Malicious SMS and iMessage Interception

I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
AnonAverageAlice81204's user avatar
1 vote
2 answers
185 views

report bribery: snail mail vs email vs SMS

Say I live in a western country and suspect a foriegn businessperson is trying to bribe local officials. I am provided with 3 options to report: snail mail, email and SMS. For my threat model, I am ...
user avatar
44 votes
1 answer
6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
Nathan Aw's user avatar
1 vote
1 answer
259 views

Multiple SMS activation codes received by error

For several days now I am receiving activation codes by SMS that look like this: Your ToYou verification code is 8058 Some are from ToYou, that seems to be a delivery service, others are from similar ...
The Coder's user avatar
  • 111
1 vote
0 answers
164 views

A message sent to your phone to erase another message

After giving a new credit card to a client some banks send its PIN code with an SMS. Later they send another SMS that's only purpose is to erase the SMS with the PIN from user's phone. Does this trick ...
lim-lim's user avatar
  • 29
0 votes
0 answers
118 views

Is there some way to "fully delete" received and sent SMS messages (and any other "deleted" data") on my cellphone?

I have a cheap cellphone bought about ten years ago. It has a physical SIM card. I have in-phone "deleted" all sent and received messages, but very strongly suspect that these are still ...
C Pose's user avatar
  • 1
0 votes
3 answers
554 views

What to do after opening a potentially malicious link on smartphone?

What must one do if they opened a malicious link? Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening I received an ...
Mathew's user avatar
  • 1
0 votes
0 answers
36 views

Is verification code a scam? [duplicate]

When facebook sends the confirmation code, the name FACEBOOK is not displayed as the sender,, instead phone numbers of different countries. Until now, it was only on my notebook, but today I synced my ...
Ildi Zalai's user avatar
2 votes
1 answer
945 views

Google Voice vs SMS for two-factor authentication

I'm trying to set up two-factor authentication for all my accounts. Some of them, unfortunately, only support SMS. In that case, which of these options would be more secure? SMS Google Voice (which ...
Thomas's user avatar
  • 23
12 votes
3 answers
4k views

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

And if not would like specific reasons why. I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...
Rivesticles's user avatar
0 votes
0 answers
4k views

If I receive Google verification codes that do not work, is my phone compromised? [duplicate]

I know that something similar has happened to other people before (see for instance here or here), but the situation and the question are slightly different. I wanted to log in to my Gmail account ...
57Jimmy's user avatar
  • 101
0 votes
2 answers
210 views

How much is it hard to implement a mechanism to encrypt SMSs in transit

Why service providers didn't implement something like SSL to make SMS more secure and reliable in multiple scenarios ? I did ask a question about why SMS is used as a way of verification while it is ...
Mohammed Rady's user avatar
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
Mohammed Rady's user avatar
0 votes
1 answer
155 views

Cell Phone texting [closed]

Is it possible for someone to redirect text messages to you from another’s phone? Something weird is going on…over the last few weeks I have received “wrong number”text messages from people with ...
danielle miller's user avatar
-1 votes
3 answers
1k views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
stevec's user avatar
  • 1,280
1 vote
1 answer
450 views

Received a strange text message. What is it? [closed]

This morning I received the following text message from a Gmail account: v3s5f3rs4f3gs3.nf5j4k8j4k3o.solar?G$1?V&?KL?O=$HO?&S?K0?$1T A couple of my friends got it too. I have an iPhone and it ...
Wes Sayeed's user avatar
0 votes
0 answers
737 views

Facebook and Yahoo 2FA SMS codes from odd numbers [duplicate]

When logging in to Facebook/Yahoo mail, I receive my 2FA codes from random numbers. Here are some examples (I have a Romanian phone number, hence the country codes): +40 747 691 103 +40 727 347 814 +...
hyperio's user avatar
  • 101
4 votes
0 answers
558 views

What is "JavaGhost - Mass Twilio Checker"?

Over the past week, the account credentials for my organization's Twilio account were stolen and used to send ~10,000 fraudulent SMS messages claiming to be from a major bank. The passwords have all ...
Moshe Katz's user avatar
  • 1,360
1 vote
1 answer
153 views

How to decrease the fraud level on SMS verification

To prevent fraud, we require the users to link their account to a mobile phone number. We send a code by SMS. Fraudsters use hacked social networks to convince "friends" to send them the ...
Toto's user avatar
  • 193
0 votes
1 answer
231 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
Jonatan's user avatar
  • 101
0 votes
2 answers
157 views

I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]

I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
zneak's user avatar
  • 207
1 vote
1 answer
155 views

Spoof texting a regiatered number to yourself and relying....having a conversation [closed]

I feel like I am going crazy. A friend was at my house and received text messages from a number from a person i know. She had a conversation with this number for basically a week. She is now saying ...
Abbs CP's user avatar
  • 11
2 votes
0 answers
229 views

Received Google 2FA Code via SMS from two unknown phone numbers [duplicate]

I recently encountered a strange incident regarding the 2FA of my Google Account. The user Dunois has described a very similar occurrence in this post: Functional Google 2FA code (via SMS) received ...
marlon's user avatar
  • 21
1 vote
0 answers
108 views

Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]

I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
Lionel's user avatar
  • 11
3 votes
2 answers
376 views

Someone uses my service to spam people with sms. How to deal with this?

Every time when user wants to login to my service it sends one time password (OTP) to the user's phone number, then this OTP is used to confirm login. Someone uses my service to bombard people with ...
aiven's user avatar
  • 131
1 vote
2 answers
4k views

How to spoof IMEI/SIM location?

Once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s). source Is there a way to spoof the location ...
Napal's user avatar
  • 155
1 vote
1 answer
131 views

Which practices should i use while generating SMS codes for auth on my project?

Let's imagine that we have an SMS verification auth, and using random 4-digit codes, i.e. 1234, 5925, 1342 and etc. I'm using this random inclusive algorithm on my node.js server: function ...
Андрей Мильнер's user avatar
3 votes
1 answer
320 views

Is phone number verifications with SMS magic HTTP links less secure than OTP?

I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server ...
Visar's user avatar
  • 33

1
2 3 4 5