A text arrives from a number you have never seen: "Hi mom. I lost my phone. This is my new number." A few friendly messages later it asks for money for a bill, today. Nothing in that chat ever proved who was typing.
This is not a coding post. But if you build login flows, you already know this bug, and you are probably the person your family will ask about it. So here it is, written the way we would write up an auth failure.
The attack, message by message
For our short video I rebuilt the chat on screen as a phone conversation. To be clear: it is a re-creation that we wrote, not a real victim's chat. The steps follow the pattern the Australian regulator ACCC described in its media release of 23 August 2022 (the live page answered our requests with a 403, so I read it through a Wayback Machine copy).
[Unknown number] Hi mom. I lost my phone. This is my new number.
[You] Oh no! Are you ok?
[Unknown number] ...friendly small talk...
[Unknown number] Mom, I need money for a bill. Today.
The replies in the middle are ours, the opening and the ask are the pattern. The ACCC puts it like this: the scammer "will claim they have lost or damaged their phone and are making contact from a new number", and then, "once they have developed a rapport", asks for money "to help urgently pay a bill". It adds a detail that closes the last exit: the story is that they cannot reach their online banking for now, which is why the money has to come from you.
The ACCC counted more than 1,150 victims and A$2.6 million in reported losses in Australia in the first seven months of 2022. Those numbers are old and from one country; they show the pattern is real, not how big it is today.
The short version:
Why it works: every signal is one the attacker controls
Look at what you are asked to trust.
| Signal | Who controls it | Proves identity? |
|---|---|---|
| The name "Mom" or "it's me" in the text | The sender | No |
| The new number | The sender | No |
| A voice on a call | The sender, per the FBI | Not any more |
| A word you agreed on face to face | Only your family | Yes |
| A call you place to the saved number | You | Yes |
The first message does the real work. "This is my new number" is an account recovery request: please move your trust from the old channel to this one. And you approve it by replying, with no check at all.
The usual answer is "I would know my own kid's voice." The FBI's Internet Crime Complaint Center says that is no longer a safe check. Its alert I-120324-PSA of 3 December 2024 states: "Criminals generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom." The alert does not say how much audio a copy needs, so I will not guess.
The fix is two things you already ship
A shared secret. The same FBI alert gives the tip in one line: "Create a secret word or phrase with your family to verify their identity." It works for the reason a pre-shared key works: it was agreed outside the channel under attack, so the person on the new number cannot look it up.
[Unknown number] Mom, I need money for a bill. Today.
[You] What is our code word?
[Unknown number] ...
No code word, no money.
An out-of-band check. The ACCC's advice is to "start by calling them on the number already stored in your phone". You start the call, on a channel you already trusted before the message came. If they pick up, you know the text was a scam.
Both checks cost about a minute. A real family member can wait one minute. The whole scam depends on you not waiting, which is why the bill is always due today.
Limits
- I did not test this against a real scammer, and I did not clone a voice. The chat is a re-creation and the claims come from the two public sources above.
- A code word only helps if you set it before you need it, and if nobody types it into the same chat they are trying to check.
- The ACCC also covers the case where the old number does not answer: try a second contact method, then ask a personal question a scammer could not know.
What I have not solved: how do you rotate a family code word after someone says it out loud in the wrong place, without the new one leaking the same way? If your family already does this, I would like to hear how.
Top comments (0)