Online SMS Verification Services: Cybercriminal’s New Favorite Tool
Executive Summary
- Cybercriminals and fraudsters engaging in various types of cyber and financial crimes often exploit SMS authentication mechanisms in order to achieve their objectives.
- Many of them do so by utilizing rogue SMS verification services advertised on the Dark Web and on Telegram that allow them to receive text messages containing an OTP (One Time Password) in order to complete a new account sign-up, access a compromised account, and more.
- These SMS verification services have advanced features such as:
- Choosing numbers targeting specific sites or services to bypass their anti-fraudcontrols.
- Renting a number for different periods – from as little as 10 minutes to 30+ days.
- Choosing a phone number associated with a specific postal code.
- Underground SMS verification services are easily accessible with prices starting as low as $0.50 for a short-term access.
- We expect to see more and more of such services over the coming years, offering sophisticated features, a phenomenon that might make SMS-based 2FA less effective.
What is SMS Verification?
SMS verification or multi-factor authentication dates back to 19961, and was designed to combat different types of fraud and cybercrime, including account takeover and new account fraud. Over the years, additional methods of two-factor authentication (2FA) have been developed, including hardware tokens, voice-based authentication, and push notifications, among others.
One of the most popular types of 2FA is SMS verification (also known as OTP verification2). SMS 2FA verification process is quite simple and straightforward:
- Accountholder provides a phone number during the sign-up or the sign-in process.
- Accountholder receives a text-message with an OTP (i.e., one-time code).
- Accountholder inputs the code to authenticate and successfully finish the process.
SMS verification is widely used by financial institutions, social networks, email providers, e-commerce shops, and many other online platforms to confirm the identity of their users. SMS verification is very popular due to its:
- Security: SMS verification process adds a strong layer of security to user authentication.
- User-friendliness: Typing OTPs is quick and easy, making it a very convenient authentication method for the user.
- Accessibility: SMS verification requires no additional hardware or software rather than a mobile phone, which the vast majority of people possess.
Cybercriminals and fraudsters engaging in various types of cyber and financial crimes, such as fraudulent new account registration and account takeover, have to pass the SMS verification process in order to execute their objectives. To meet this growing demand, underground SMS verification services appeared, offering user-friendly interfaces and custom capabilities. Vendors are promoting their services on different underground communities at affordable prices in order to attract as many customers as possible.
Underground SMS Verification Services
How do they work?
Underground SMS verification services are often built on top of Android botnets with hundreds, thousands, or more Android mobile devices that are infected by malware. The malware operator is able to control the mobile device (to varying degrees, based on the malware) and read data sent to the device. Therefore, when an SMS is received by an infected mobile device, the malware is able to extract it.
The infected devices are used to receive SMS messages without the owner’s knowledge. More specifically, when a cybercriminal purchases an SMS verification service, one of the infected Android devices is made available. The phone number associated with that device will be used by the cybercriminal (for example, for verification to open a new email account), and the code sent to the device is then intercepted by the malware and provided to the cybercriminal.
In addition, other services have a different modus operandi involving SIM Banks3 (also known as SIM slots) and Android botnets. By this method, the services allow users to use multiple phone numbers on one device.
Underground SMS verification services roll out new numbers on a frequent, almost daily basis.
Cybercriminals and fraudsters require the ability to receive text messages with an OTP for various schemes, for example:
- Fraudulent new account registration – phone numbers are mandatory when creating new accounts on certain platforms. The criminal obviously does not want to use a phone number that is associated with him.
- Account takeover – when taking over online accounts, a criminal may wish to change or add a mobile number to the account profile, which will subsequently be used to authenticate when carrying out certain transactions.
Some SMS verification services offer phone numbers that are dedicated to specific sites and applications. For example, a cybercriminal targeting Airbnb, requiring an SMS verification message with an OTP from Airbnb, may purchase a virtual phone number that is specifically designed to detect Airbnb messages. Such phone numbers are likely associated with mobile devices that are compromised by malware, and the malware is capable of detecting SMS messages sent by Airbnb. In addition, some SMS verification services provide numbers that are tied to specific zip codes. This helps criminals bypass advanced anti-fraud controls such as geolocation monitoring victim.
Underground SMS verification services offer access to virtual phone numbers for different periods of time, which vary from service to service. Furthermore, access for a custom timeframe can be arranged as well. Subscriptions are typically offered as follows:
- Short-term subscription: 5-to-15-minute access. The virtual phone number is available for one-time use only.
- Long-term subscription: One to several weeks of access. The virtual phone number can be used multiple times during the period.
What is the cost?
Underground SMS verification services are easily accessible with prices starting as low as $0.5 for short-term access. With that said, the final price may vary depending on several factors, including length of subscription and call features. It’s not uncommon to find virtual phone number priced as high as $70 for a 30-day access with a call-forwarding feature.
The registration process for these services is simple. A user creates a private account which he could top-up and use to purchase virtual phone numbers. Users may top-up their accounts by payment via credit or debit cards or cryptocurrencies such as Bitcoin, Ethereum, and others. Most services accept payment by Mastercard, Visa and American express payment cards, a fact indicating that these services are used not only by cybercriminals neither for illicit purposes only.
Where can they be found?
Underground SMS verification services are widespread, appearing in:
- Underground cybercriminal forums
- Underground cybercriminal marketplaces
- Telegram
Underground forums are one of the first places underground vendors go when they want to advertise their services. Many underground forums have a dedicated section discussing and promoting underground SMS verification services. For instance, on the technologically sophisticated Russian-speaking underground forum XSS4, there is a section tagged as “приём смс” which in English simply means “receiving SMS”, where various vendors promote their services.
Many underground marketplaces, such as just-kill5, include SMS verification services in the list of goods and services they provide. Such marketplaces are one-stop shops providing cybercriminals with a wide array of tools helping them executing illicit schemes. Among the offered services, one may find payment card checkers, flooding tools, VPN services, and SMS verification services.
Underground marketplaces are an attractive platform for users of SMS verification services since they offer a “one-stop shop” for all other needs, and may even often offer an admin or a management dashboard to conveniently manage and analyze multiple activities.
Another platform where underground SMS verification services prosper is Telegram. Many of these services are available via Telegram bots6, offering fast access and user-friendly environment.
Conclusion
SMS verification is a crucial step in many online login and registration workflows, which cybercriminals are continuously attempting to exploit. As the demand rises, an increasing number of underground SMS verification services available on different underground platforms are accommodating the demand. The services have much in common. We expect to see more and more of such services over the coming years, offering sophisticated features, a phenomenon that might make SMS-based 2FA less effective.
* Disclaimer: This document is provided ‘as is’ for informational purposes only, without any warranties of any kind regarding any information contained within.
2One-Time Passcode – a code that is used to authenticate a log-in or a registration.
3Sim Bank – hardware module connected to a device which allows users to use multiple SIM cards at the same time. When such bank is connected to a computer, a user would have “virtual” phone numbers accessible from the computer.
4www[.]xss[.]is.
5www[.]just-kill[.]pro.
6Programs offering automations for Telegram users by integrating them in their chats, channels, or groups.