Toll Fraud: What You Need to Know About This Latest Scam

As the world becomes more technologically advanced, so do the hackers who monitor the industry. There is always a new threat to consider, and toll fraud is no different.  This is a growing threat, one that could go unnoticed by consumers if they are not made aware of the warning signs and precautions.

So, what is toll fraud? In a nutshell, toll fraud is an increasingly common form of malware aimed at mobile devices.  What exactly is the threat? The cyber criminals who use this method are stealing small amounts of money from users, and that money is coming directly out of your pocket by showing up on your phone bill in the form of a charge fee. This charge can go unnoticed if you aren’t inspecting your phone bill each month so you can understand where each charge came from.

I will explain how this whole process works, but first I want to explain specifically what malware is and how it works. Malware is short for malicious software, and Wikipedia defines it as, “software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems.” Malware can be anything from a small computer virus to a Trojan horse. Hackers use this software to find personal information, generally in order to make a profit. The toll fraud scam is no different.

So how do hackers end up getting your money, and disguising it as a charge on your cell phone bill? Meghan Kelly from VentureBeat describes the process like this: "You know those commercials that say, "Text 555555 to get a new ringtone every day!"? When you text to that number, a trusted chain of about five steps happens:

1.       A customer texts the number, alerting an aggregator — working for the ringtone provider — that he wants to order daily ringtones.

2.       Through the aggregator, the ringtone provider sends a confirmation text message to the customer (or sometimes two depending on that country’s regulations) to the customer.

3.       That customer approves the charges and starts getting ringtones.

4.       The customer is billed through his wireless carrier.

5.       The wireless carrier receives payment and sends out the ringtone payment to the provider.

 

Make sense? Here’s how the malware, notably the most popular form called FakeInst, works:

1.       A customer downloads an app that sends out an SMS message to that same ringtone provider.

2.       The ringtone provider sends the confirmation message, but instead of reaching the smartphone owner, the malware blocks and confirms the text message before the user ever knows.

3.       The malware writers further jump in between the wireless carrier and the ringtone provider, pretending to be an aggregator, and collect the money you just paid through your bill.”

Nervous? I wouldn’t blame you. Once I started learning about this, I began to wonder if I had fallen victim to this scam. I fully intend to look over my next phone bill with a magnifying glass to ensure I don’t pay any unnecessary charges.

This scam primarily attacks Android devices because these devices can download apps from anywhere, whereas iOS devices can only use the Apple App Store to purchase apps. This is not to say that iPhones are not vulnerable, but Androids are the far more likely candidate.

This problem only seems to be getting worse, and Lookout Mobile, a security company, quotes some alarming statistics. Lookout estimates that, “From the beginning of 2012 to the end of 2013, a total of 18 million users of Android devices might encounter malware, and about 72% of the malware found in 2012 was toll fraud.”

This is definitely something to keep in mind and be watchful of. You should always check any bill you get to make sure the proper charges are in place, but with this new scam it is even more imperative that you fully inspect your phone bill. It also wouldn’t hurt to be mindful of apps that say, “Text this number to get a talking kitty to send to your friends.” There are some legitimate ones out there, but do some research on the service provider before you commit. These are just some of the ways you can protect yourself from malware attackers.

That is all I have for this week, and as always I am open to any questions or discussions you guys want to have. Thanks for listening!

Until next time,

Julie

 

Sources:

http://bits.blogs.nytimes.com/2012/12/13/lookout-toll-fraud/

http://venturebeat.com/2012/09/06/toll-fraud-lookout-mobile/

http://en.wikipedia.org/wiki/Malware