What just happened? British authorities have arrested two suspects for allegedly running a "homemade mobile antenna" to send thousands of spam texts impersonating banks and other organizations. It's being called the first scheme of its kind uncovered in the UK.
The cybercriminals are accused of piecing together an illegitimate cell tower or "SMS blaster" device to bypass mobile carriers' systems for filtering out sketchy text messages.
One man, 32-year-old Huayong Xu of Croydon, has been charged so far with possession of articles for fraud stemming from the alleged SMS spam setup. He's being held without bail ahead of a court appearance at the end of this month. Meanwhile, a second suspect arrested in Manchester back in early May was released on bond.
The operation was led by the City of London Police's Dedicated Card and Payment Crime Unit, which has been working the case alongside regulators like Ofcom and cybersecurity agencies.
"The criminals committing these types of crimes are only getting smarter, working in more complex ways to trick unknowing members of the public and steal whatever they can get their hands on," said Detective Chief Inspector David Vint, head of the specialist police unit. "It is vital we work with partners to help prevent the public from falling victim to fraud."
While the police offered sparse details, it's being speculated that the scam could involve a particular piece of mobile hacking hardware called an IMSI catcher, commonly known as a Stingray.
These controversial devices, normally used by law enforcement for investigations, can trick nearby phones into connecting to a spoofed cell tower set up by the bad guys instead of a real carrier network. From there, the crooks can bypass security controls to bombard connected devices with spam/malware.
It's always advised to be vigilant against suspicious texts claiming to be from banks or companies and asking for sensitive info, and Vint cautioned the same. "Remember, a bank or another official authority will not ask you to share personal information over text or phone."
London Police also highlighted that most major UK carriers let you forward sketchy texts to 7726 free of charge so they can investigate the sender and block any other threats.
Besides this, users are also advised to disable 2G on their phones since many of these IMSIs are dependent on the network. In the US, every major carrier has already disabled their 2G and 3G networks.
In 2021, Google introduced an option to disable 2G on Android, but most manufacturers, including Samsung, haven't implemented it. Apple also overlooked this issue until iOS 17, which now includes Lockdown Mode to block insecure 2G connections on iPhones.