It's been a couple months since our last update, but that doesn't mean these scammers and fraudsters have given up or slowed down - far from it. Scammers are always looking for ways to get unsuspecting users to click on dodgy links, visit fake websites, or dupe you into giving out personal info.
'Flubot' looks like it's on the rise again and this time with a twist.
First, a quick recap on how Flubot 1.0 (SMS) works:
What's changed with Flubot 1.1 / 2.0? It's important to note that Flubot 1.0 is still in circulation and you could be sent one of those, or potentially one of these new ones from Flubot 1.1 / 2.0:
Please remain vigilant when receiving an SMS or MMS. If it's not from someone you know, or a business/company you're familiar with, then be cautious and think twice before opening any links. And even if it is from somebody you know, be cautious of any dubious looking links - it's possible your friends phone could be infected and it sent you one of the links.
Received a suspicious SMS or Email? There's no need to contact us. See below hints and tips for spotting these scams, and what to do with them.
We often see reports from customers who believe that they may be at risk from fraudsters trying to dupe them into sharing their personal information. These types of scams are known as phishing or smishing – a form of fraud which impersonates a company in order to steal sensitive information such as login, bank or other personal details. We’ve pulled together some information to help you identify these scams and keep your information safe.
What is it?
Phishing or Smishing is when fraudsters attempt to get hold of sensitive information such as usernames, passwords or bank details by pretending to be a trustworthy source in emails (Phishing) or texts (Smishing). These scams work by sending you an email or text that looks like it’s from your bank, service provider or other company, usually asking you to visit a fake website that looks real. If at this point you try logging in, or provide any info, fraudsters will attempt to use that info to commit fraud in your name.
What are you looking for?
As with many scams, it begins with an email or text. Some of these may be from scammers pretending to be O2, and may alert you to an unpaid or overdue bill, and will include a link to pay or ‘view your bill’. This messaging is designed to panic recipients into clicking the link to view the bill.
Clicking the link will either direct you to a fake website or in some cases, download Malware to your computer. The most common type of phishing email will direct you to a fake website and ask you to enter your login details. Malware can be used for a number of things – for example, it could record your keystrokes, enabling fraudsters to piece together even more personal information and login details.
Signs of a Phishing or Smishing Scam
It’s often easy to spot a scam. Be on the lookout for:
Here are some examples of Phishing emails:
Here are some examples of Smishing texts:
What to do
If you’re suspicious about an email you’ve received and it's pretending to be from O2, please send it onto our team to be looked into. DO NOT click on any links. It’s important that we see examples of phishing emails and websites so we can investigate and shut down scammers. To report a suspicious email or website:
To report a suspicious text pretending to be from O2, forward the original message to 7726. You may get an automated response thanking you for the report and giving you further instructions if needed. You will not be charged for sending texts to 7726.
Alternatively, if your phone supports SPAM reporting (currently available if you have an Android device using the Google Messenger App, but others will be available soon), then press the SPAM button to automatically forward the message to 7726.
For more info about phishing from our support pages, click HERE.
For more info and advice on how to safeguard against fraud, visit the Fraud Advisory Panel.
For more info on spam texts click here.
We'll update this thread regularly, as and when there are new scams you should be aware of, or we want to share any details that will help ensure you don't fall foul to scammers.
We have seen news and media reports of a zero click malware vulnerability within iOS that has been patched with the latest iOS 14.8 update. Please see more info below and update your devices as soon as possible to stay safe and secure.
This week Apple has released an emergency software update for all iPhone, iPad and Mac users, to prevent the use of a 'zero-click malware'. A zero-click attack is especially devious as it means a user has no chance to catch the attack because it requires no action on the user’s part to trigger it - it’s not like a phishing email or smishing sms where the user has to click on a link or download a piece of malware.
Whilst alarming, we don’t need to panic, as these types of attacks tend to be very targeted, and in the past have been used to access messages on specific and targeted individuals, like a journalist’s or politician’s device.
WHAT DO I NEED TO DO?
Simple – you should update your device to the latest update as soon as possible.
We know Flubot has been in the news more recently due to it becoming a heavily used form of smishing by these scammers, so we want to update you with more information on what Flubot is, how to spot it, and how to stay safe. See full update below for more info.
Flubot scam - What is it?
Flubot is a text message scam. It is part of a large scale smishing attack using a malware named Flubot. Currently it is only impacting Android devices, and is downloaded under the guise of a tracking app or a message with a link to retrieve a voicemail which is installed when you click on the attached link.
If you install the app the malware is then able to take over your device and this allows more infected SMS to be sent to contacts within your device without your knowledge.
Please be aware that if you do install the app, your contacts and your banking apps may have been accessed by the fraudster.
If you have received the message but not clicked on the link and downloaded the app, you can report the message to 7726 and then delete it.
If you have downloaded the app and believe your device has been infected, you will need to remove the malware from your device and you can do this by following the actions recommended by the National Cyber Security Centre, which is to perform a factory reset on your device, which will wipe the device and remove the malware. To carry out a factory reset, please visit the National Cyber Security Centre’s website and search on the text “flubot guidance”. You should NOT perform a back-up to reinstall anything on your device after the factory reset, as that will also reinstall the malware.
Other options that MAY be available are:
I believe my device is infected – What should I do ?
Please forward the original text message to 7726
If we have identified that your device may be infected by Flubot as part of the monitoring of our network, we may bar your outgoing SMS in order to protect you, your contacts, and our network. To have this SMS bar removed, please follow the advice below on how to remove the malware. Once you have done this please contact customer services
If you advise us that you have removed the malware but this has not been completed, the outgoing SMS bar is likely to be reinstated.
If you have incurred charges to your bill due to Flubot, this will be reviewed and where applicable these charges will be credited back to your account.
However, if you advise us that you have removed the malware and this has not been completed, and you continue to incur costs due to Flubot you may be liable for these charges.
We have seen a number of new examples of the Flubot scam and are taking actions to protect customers from these. We have also made an upgrade to 7726 to make it easier to report calls.
We have had reports of a new variant of the Flubot issue and wanted to highlight what these look like.
You will receive a SMS advising you have a missed voicemail and to click the link provided. Please don’t and if you have see the guidance below on the actions to take.
Please continue to report these to 7726 as it allows us to take the appropriate action to shut these down.
We have now completed a small upgrade to 7726 so that it is easier for you to report a Voice Call rather than just SMS.
To make it easy for you the system will only require a single message
If you receive a call then you should report it as follows:-
Voice (Calling number) e.g. Voice 077305***** or Voice 4477305*****
No words or comments should be included otherwise it will be registered as a text message and not a voice call.
When used you will see the following response:-
Thanks for reporting a nuisance call. The details will be shared with the other operators and law enforcement teams
We've started seeing some texts claiming to be from O2 More or My O2 that refer to various gamling offers or websites, though may not be exclusive to just gambling offers - it's just that that's what we've seen so far. More details below.
I wanted to highlight a few texts we've seen originating from a spoofed 'My O2' or 'O2 More', usually related to gambling offers - but this may not be exclusively. See below some recent examples we've had.
Some of the usual 'tells' that this is a scam and not from O2 can be seed in typos, grammar or punctuation mistakes, such as:
It can be difficult to tell what's a scam and what's real though, so please continue to be vigilant and if you're in doubt, it's best not to open these texts or tap on any of the links. Continue to follow our previous advice to forward suspected scam texts to 7726 for us to investigate.
We wanted to alert you that we’re starting to see new variations of the recent Flubot SMS scam you may have read about here, on our Social Media feeds, or via the news. Some variants we have seen so far include messages pretending to be from UPS, ASDA and others. We wanted to clarify a couple of points that we hope will help keep you safe over the bank holiday weekend.
How Flubot works
What to do if you receive one
If you receive a text or email you weren’t expecting and it’s asking you to tap on a link, be suspicious and scrutinise the details. If it’s from a random mobile number, chances are high it’s a scam text. If the link looks odd, chances are high it’s a scam text. If the text has typo’s or poor structuring, chances are high it’s a scam text. In these cases, please forward the text to 7726 for our security team to take further action.
If you get such a text and everything looks absolutely fine, or you were expecting a delivery from the courier mentioned and you think it might be genuine, we urge you to use caution and to contact the company in question to confirm its legitimacy before tapping on any links. If the courier/business cannot confirm the legitimacy of the SMS, please forward the text to 7726 for our security team to take further action.
For more guidance, please visit the National Cyber Security Centre
Mobile network operators are aware of the Flubot SMS scam and are advising customers to be vigilant and careful about clicking on any links received in an SMS. For the full update, tap here or view it below.
What is the Flubot SMS scam?
The Flubot SMS scam is a piece of malware that impersonates other apps on a victim’s phone to steal their banking credentials and other private information. It spreads through SMS and can eavesdrop on incoming notifications, read and write SMS, make calls, and transmit the victims’ entire contact list back to its control centre.
Actions to take if you believe you have received a Flubot text message
If you believe you have received a Flubot message, customers should forward anything suspicious to 7726 so the links can be tracked.
Be Vigilant and Aware
The best advice if you’re unsure is to ignore, report, and delete.
Here's an example of a Flubot SMS. If you receive anything similar, please don't click any links. Report it as instructed above, then delete it.
AUGUST 2020 UPDATE
I wanted to share some recent examples of phishing, smishing and scams in general. All of the advice in the original post further up is still correct and up-to-date, and you should always maintain vigilance when you're unsure on the legitimacy of any message you receive. The information below is purely to update you on some of the new techniques we're seeing at O2, with the hope it helps more of our customers stay safe and secure.
Firstly, a quick update on the terminology:
Before we get into this one, it's important to know what 'Wangiri' means. In Japanese, it translates to 'one ring and drop'. The purpose of this scam is that you'll receive a phone call from some unusual or obscure international number, which will typically terminate before you ever get a chance to answer it (which you never should).
Unsuspecting customers who see a missed call may not think twice about calling back... What if it's a family member on holiday? This is exactly what these scammers are hoping for and as soon as you call that number back, bang, that's you just been stung a hefty premium rate call charge. What's O2 doing about these? We block numbers are soon as we become aware of them, and have investigated them. In many cases we'll have outbound blocked the number before you even receive the dodgy call, but these scammers are all around the world and new numbers are setup often, so this kind of scam is unfortunately likely to exist in the world for as long as there are phones.
Recent smishing examples
Smishing, like above, is likely to be something that will always exist, so it's important that customers on all networks, all around the world, remain vigilant and be able to spot the signs of a smishing attempt to ensure they don't get caught off guard and find themselves with extortionate charges due to falling for these scams.
See the screenshot below - this is a common example of the kind of smishing report we're receiving regularly, with the only thing changing from text-to-text being the URL. Don't worry about the number - that's the number of the scammer, and not of any customer.
There are several things to note from this smishing example:
Flyers and other scams
Unfortunately the list goes on. Scammers and criminals will do anything for an easy £ and as their desparation grows, so too will the complexity of their scams. Other recent scams we've witnessed have been:
JANUARY 2021 UPDATE
I wanted to bring to your attention a new, clever, and very convincing scam that is doing the rounds via text message (smishing). The ongoing Covid-19 situation is cause for concern for all of us and this scam prays on fear and vulnerability in the hope that you won't think twice about it being illegitimate.
The text pretends to be from the NHS and says "We have identified that your are eligible to apply for your vaccine" and to click on a link to apply. When you click the link it takes you to a very convincing looking website made to look like the real thing (see screenshots below) which then asks you for a load of personal details including your name, date or birth, address, proof of address, and payment card details. Obviously with all of this info, scammers could cause a lot of havoc and commit fraud in your name, and this request for detailed personal information should be your first warning point.
Please note, this is not customer services and we cannot access your account. Do not publish personal details (email, phone number, bank account).
Link to our guide on how to contact them can be found here