Why can’t our mobile networks stop scam texts?

Victims are losing thousands of pounds but Vodafone, EE and others seem powerless to stop it. Howard Mustoe and Will Kirkman report

Mobile networks have admitted they cannot filter dangerous messages that are costing innocent people thousands of pounds. Scammers are running riot while mobile phone companies face a losing battle against a text message fraud epidemic. Britain’s banks have been forced to act, refunding millions to fraud victims, but now experts say mobile providers must urgently upgrade security.

Richard De Vere, director of the AntiSocial Engineer, a cybersecurity consultancy, said businesses should not send SMS text messages at all to protect their customers.

There has been a spike in consumers reporting suspicious texts as scammers impersonate parcel delivery firms, banks and Royal Mail, taking advantage of locked- down workers shopping online.

In recent years public bodies, banks and other big companies have used texts to communicate with customers and send them confirmation codes as a security measure, which has led to consumers trusting the messages, despite huge holes in SMS security.

“We can’t even pretend that we can trust it any more,” said Mr De Vere. “It’s really old tech, but scammers are just starting to understand how powerful it is.”

SMS text messages are an attractive option for companies and even governments to communicate because of their ubiquity – nearly all mobile phones can receive them. But they were never intended as a mass communication tool, said Mr De Vere.

“There is no authentication,” he said, which means a message can pre

‘The lady on the phone told me to transfer every penny to a safe account’

Royal Mail: Your package has a £2.99 shipping fee, to pay for this now visit royalmailredelivery.support. Actions will be taken if you do not pay this fee

sent itself as being from a bank or a delivery firm when it’s really from a criminal. Used correctly, text messages can help cut fraud by issuing warnings and notices, such as about new payees. But this system teaches customers to trust texts – and it is this trust that scammers then take advantage of. Anushka Lahiri, 18, from Birmingham, lost more than £5,000 after she fell victim to a scam text purporting to be from Royal Mail. Ms Lahiri had recently moved to Britain from Singapore to study medicine when she received a text asking her to pay a small fee for a Royal Mail package.

After she had paid the fee, she received a call from a number that showed up on her phone as being from Lloyds Bank.

She said: “The lady on the phone was very sweet and told me that someone had been using my account. She had me transfer every penny I had into a ‘safe account’ in my name, which I know retrospectively was incredibly stupid, but by the time I realised it was too late.”

After she contacted Lloyds she was eventually reimbursed around £1,150, which was all the fraudsters had left in the account.

She said: “Lloyds said there was no insurance for bank transfers and there was no way they could refund me the remaining £ 3,860. I broke down in tears.” Ms Lahiri has now filed a complaint over Lloyds’ handling of the case with the Financial Ombudsman Service.

Royal Mail said it would send email and text notifications to customers only if the sender had requested them for trackable parcels. Lloyds said it was investigating the case.

Peter Henderson, 63, from London, who initially lost £3,000 to a text scam before his bank refunded him, said: “It was a horrible experience. One gets angry and emotional while it goes on, and this affects your judgment.”

Vodafone, O2 and EE, three of the biggest mobile operators, would answer questions only through their lobby group Mobile UK and declined to say how they were individually tackling scams. The network Three did not respond to requests for comment.

Mobile UK said the industry had put in place measures to combat fraud. It said it had helped launch a programme last year called SMS Sender ID, which protects certain government and brand names from being misused and helps share data on scam texts.

But it admitted that there was currently no way to filter spam in the way email providers have been able to do for decades.

The industry encourages customers to flag suspicious texts themselves, but Mobile UK refused to say how many had been reported.

‘You get angry and emotional while it goes on. It affects your judgment’