Rise of SMS-Based Mobile Fraud Through Smishing and OTP Interception

Criminals are increasingly abusing SMS as a fraud channel, using both network-level and device-level techniques to bypass traditional defenses and steal credentials, banking data, and one-time passcodes. One reported method uses SMS blasters—portable false base stations or cell-site simulators—to inject phishing texts directly into nearby phones without traversing carrier networks, allowing messages spoofing government agencies or banks to evade carrier spam filtering. Another technique targets Android devices through the LSPosed framework and the Digital Lutera module, enabling attackers to capture SMS verification tokens, impersonate phone numbers, insert fraudulent SMS records, and support real-time payment app account takeover and transaction approval.

The fraud ecosystem also includes large-scale smishing campaigns built around fake parcel delivery notifications, with Group-IB reporting sustained growth across the Middle East and Africa and postal brands most frequently abused. Those campaigns use urgent shipment-tracking lures to drive victims to counterfeit courier sites that harvest personal data, card details, banking credentials, and OTPs. Together, the reporting shows that mobile fraud is expanding through both social engineering and deeper technical abuse of telecom and mobile operating system trust models, exposing weaknesses in SMS-based authentication and message trust assumptions.