Chapter 20: Fraudulent SMS: The Message That Opens the Door

We carry our lives inside a small piece of glass and metal weighing no more than two hundred grams. Our smartphone is our safe, photo album, appointment diary, and wallet. And like any safe, it has a weak point. It is not found in Apple's coding or Google's servers; it is in the palm of our hand. In the world of information security, the SMS (or Smishing—a combination of SMS and Phishing) is considered one of the most effective Trojan horses ever created. It is simple, it is cheap, and it exploits the most basic human instinct: the immediate response to the "ding" sound that heralds a new message.

While email is perceived by most of us as a noisy space, full of advertisements and spam that require careful filtering, SMS still enjoys an aura of urgency and reliability. When we receive a text message, we tend to assume it is intended for us personally. It could be a verification code from the bank, an update from a delivery company, or a message from our child's kindergarten. This trust is exactly the door that scammers seek to open. In this chapter, we will analyze how a short text message, sometimes fewer than ten words, manages to bypass all the defense mechanisms of a reasonable person and lead to the potential for financial and emotional harm.

The Anatomy of the Scam: Erez's Story

The following scenario is an educational example based on common fraud patterns. The characters and events are intended for illustration only.

Erez, a 45-year-old accountant from Ra'anana, is considered a cautious person. He has never given his credit card details over the phone, he changes his passwords every six months, and he is the one who installs antivirus software for the whole family. But one Tuesday, at seven in the evening, while he was simultaneously trying to prepare dinner for three hungry children and answer emails from the office, his phone vibrated on the counter.

The sender appeared at the top of the screen as "Bank_Security." Not a phone number, but an official name. The message was short and concise: "Suspicious login detected on your account from an unrecognized device in the Georgia area. If this was not you, you must access the following link immediately to secure the account and prevent it from being blocked." Below the text appeared a shortened link: https://bit.ly/bank-protect-il.

"Damn it," Erez muttered. His heart rate spiked instantly. His logical brain, the one that analyzes corporate balance sheets, was pushed aside in favor of his survival brain. He did not think about the fact that the bank never sends shortened links. He did not stop to ask why a message from his bank came from a sender with a name in English. He only saw the words "suspicious login" and "blocked."

Erez clicked the link. The phone browser opened and displayed a page that looked exactly—but exactly—like his bank's login site. The same colors, the same logo, the same reassuring words about "secure browsing." He entered his username and password. Immediately afterward, a message appeared on the screen: "For final verification, a code will now be sent to you via SMS. Please enter it here."

Seconds later, another message arrived. "Your code to complete the action is 882931. Do not share this code with anyone." Erez, who was convinced he was in the middle of a security process, entered the code on the site. The screen loaded for a few seconds and then displayed a reassuring message: "Your account has been successfully secured. Thank you for using our services."

Erez breathed a sigh of relief and went back to cutting the salad. Only half an hour later, when he logged into the bank's app (this time through the official app, not the link), did he discover the bitter truth. His account was not secured. While he was entering the code, the scammers used it to set up a "new beneficiary" for money transfers. A significant sum of money disappeared from the account. The funds were transferred to another account and withdrawn within minutes.

At that moment, Erez's kitchen felt like it was spinning. The sense of self-betrayal was harder than losing the money. "How could I have been so stupid?" he asked himself again and again. The answer is that Erez was simply acting under pressure, and he fell victim to precise social engineering.

The Psychology Behind the "Click": Why Does It Work?

To understand why a fraudulent SMS is such a lethal tool, we must understand the technology and psychology that combine within it. Unlike complex cyberattacks that hack servers, here the "breach" is carried out into the user's consciousness.

1. Sender ID Spoofing

One of the reasons it is easy to fall into the trap is the fact that the sender appears as an official name. SMS technology allows senders to define an "alphanumeric ID." This is a legitimate tool used by companies; however, scammers use these services to impersonate banks, official bodies, or government agencies. When the message is threaded within a previous, legitimate message history, the level of credibility increases.

2. Engineering Urgency and Fear

Phishing messages are designed to drive fast action using words that trigger an immediate impulse, such as "account blocked" or "urgent debt." When pressure is applied, the part of the brain responsible for critical thinking may weaken, and the impulse to act immediately increases.

3. The Small Screen as the Scammer's Ally

On a phone screen, it is much harder to notice forgeries. The links are small, the browser address bar is sometimes hidden or truncated, and the minimalist interface of the smartphone sometimes serves the scammers' purposes.

Between Human Weakness and Institutional Responsibility: Legal Aspects

When a customer contacts a bank requesting to examine the recovery of their funds, they may encounter the argument that providing the code constitutes gross negligence, which exempts the bank from liability. However, the legal analysis of these cases is more complex.

The legal starting point in Israel is the Payment Services Law, 5779-2019. This law is intended to regulate liability in cases of the use of payment instruments. Section 26 of the law establishes the liability of the customer and the payment company in the event of an "unauthorized transaction."

Is This an "Unauthorized Transaction" or "Fraud"?

This is a central legal issue. One can examine whether in cases of fraudulent SMS, the level of sophistication of the scam rises to the level of negating the customer's free will, thereby influencing the classification of the action as an "abuse."

In the legal analysis of such cases, several key questions are examined:

• The Reasonable Person Test: Was the SMS convincing enough to deceive an average person? If the message arrived through a communication channel appearing official, the degree of the financial institution's liability in protecting its channels can be examined.
• Fraud Detection Systems: Did the system detect unusual activity? One can examine whether an action that differs significantly from the customer's normal activity patterns should have triggered a "red flag" in the bank's systems.
• Duty of Care: A bank has a fiduciary duty to its customers. In a changing technological reality, one can examine whether financial institutions should bear part of the risks associated with the use of digital means.

The Issue of Gross Negligence

The law states that the customer's liability may change if they acted under circumstances of "gross negligence." It is important to note that ordinary negligence is not necessarily sufficient to exempt the financial institution from liability. The legal analysis examines whether the behavior was extreme or if it was a human error under deceptive circumstances.

Examining Options for Fund Recovery

In a scenario where a customer discovers they have fallen victim to fraud, fund recovery is not guaranteed and is not an automatic process. It requires a careful examination of the circumstances of the case. Financial institutions may create obstacles, but there are legal and regulatory tools available that can be explored.

In the case of a fraudulent SMS, the time gap is a significant factor. If the customer discovered the fraud and reported it quickly, one can examine whether the financial institution acted with reasonable skill to stop the money before it was transferred further.

Additionally, dual-verification procedures should be examined. It can be argued that a laconic code message that does not state the nature of the transaction or its amount can mislead a customer into thinking they are performing a routine security action.

Warning Signs: How to Identify the Trap SMS?

Prevention is the most effective tool. Below are several signs that raise the need for in-depth investigation:

• Creating Urgency: Messages that set an ultimatum for urgent action are often a sign of fraud.
• Suspicious Links: Slight changes in the website address or the use of URL shorteners are not common in official messages.
• Clumsy Phrasing: Poor language, spelling errors, or machine translation may indicate a fraudulent message.
• Request for Sensitive Details: Official financial institutions usually do not ask for full passwords or secret codes to be entered via an SMS link.
• Unexpected Message: Receiving a message regarding a service that was not used should raise suspicion.

Initial Steps in Case of Suspicion of Fraud

In the case of suspicion that details were provided on a fraudulent site, speed is critical:

1. Immediate Contact with the Financial Institution: Contacting 24/7 emergency centers to request the blocking of payment instruments.
2. Documentation: Saving screenshots of the message and the suspicious site.
3. Password Change: Changing passwords for essential services from another device.
4. Reporting to Authorities: Filing a police complaint as part of the inquiry process.
5. Checking Account Activity: Reviewing the list of beneficiaries and transfers made.

Legal and Professional Analysis

During the years of professional practice of an attorney handling these cases, every case is examined on its merits. The central question is whether the financial institution fulfilled its duty to mitigate the damages of the fraud.

Possible points for legal examination:

• General Alerts: Did the financial institution publish specific warnings regarding known fraud waves?
• Activity Monitoring: Did the system detect and alert on unusual activities in high amounts?
• Identifying Unusual Circumstances: Was the action performed under suspicious conditions, such as a foreign geographic location?
• Phrasing of Verification Messages: It can be examined if there is a legal basis for the argument of customer deception if the code message was not clear enough.

It is important to remember that the legal battle requires resources and careful documentation. In certain circumstances, one can examine the prospects of a lawsuit for fund recovery, and this depends on the specific circumstances of the case and the examination of evidence. The law is intended to provide protection in circumstances where the customer has been harmed, and professional legal counsel may assist in exercising one's rights.

In the next chapter, we will continue and examine fraud patterns using fraudulent email and the ways to deal with online traps.