SMS-Based Authentication and Phishing Risks via Intercepted or Mass-Sent Text Links

Recent research highlighted systemic security and privacy risks created by sign-in/authentication links delivered over SMS, showing how easily such links and embedded personal data can be exposed and abused at scale. By observing public SMS gateway services (temporary numbers used to receive texts), researchers collected 332,000 unique SMS-delivered URLs extracted from 33 million texts sent to 30,000+ phone numbers, and reported that messages from 701 endpoints on behalf of 177 services exposed critical PII. The work underscores that SMS is unencrypted and that authentication links and sensitive details can persist in accessible stores or be captured through weakly protected SMS delivery ecosystems.

Greek police separately dismantled a criminal operation in the Athens area that used a rogue mobile base station (an “SMS blaster”) concealed in a car to push phishing texts to nearby phones. Authorities said the device coerced phones to connect and downgraded them from 4G to 2G, enabling collection of identifiers (e.g., phone numbers) and delivery of scam messages impersonating banks and courier firms with phishing links used to steal payment card data and conduct unauthorized transactions; investigators have tied the group to at least three fraud cases and indicated the suspects may be Chinese nationals. Together, the reporting and research illustrate how SMS-delivered links can be exploited both through passive exposure of messages/URLs and through active, proximity-based telecom impersonation to distribute credential- and payment-theft lures.