Phishing

“Final Notice” Traffic Ticket Smishing Scam

Scott BuchananLeave a comment

Yesterday I got a scary-sounding text message, claiming that I have an outstanding traffic ticket in a certain state, and threatening me with the following if I did not pay within two days:

We will take the following actions:

1. Report to the DMV Breach Database

2. Suspend your vehicle registration starting June 2

3. Suspension of driving privileges for 30 days…

4. You may be sued and your credit score will suffer

Please pay immediately before execution to avoid license suspension and further legal disputes.

Oh, my!

A link (which I did NOT click on) was provided for “payment”.

I also got an almost (not quite) identical text a few days earlier. I was almost sure these were scams, but it was comforting to confirm that by going to the web and reading that, yes, these sorts of texts are the flavor of the month in remote rip-offs; as a rule, states do not send out threatening texts with payment links in them.

These texts are examples of “smishing”, which is phishing (to collect identity or bank/credit card information) via SMS text messaging. It must be a lucrative practice. According to spam blocker Robokiller, Americans received 19.2 billion spam robo texts in May 2025. That’s nearly 63 spam texts for every person in the U.S.

Beside these traffic ticket scams, I often get texts asking me to click to track delivery of some package, or to prevent the misuse of my credit card, etc. I have been spared text messages from the Nigerian prince who needs my help to claim his rightful inheritance; I did get an email from him some years back.

The FTC keeps a database called Sentinel on fraud complaints made to the FTC and to law enforcement agencies. People reported losing a total of $12 billion to fraud in 2024, an increase of $2 billion over the previous year. That is a LOT of money (and a commentary on how wealthy Americans are, if that much can get skimmed off with little net impact on society). The biggest single category for dollar loss was investment; the number of victims was smaller than for other categories, but the loss per victim ($9,200) was quite high. Other areas with high median losses per capita were Business and Job Opportunities ($2,250) and Mortgage Foreclosure Relief and Debt Management ($1,500).

Imposter scams like the texts I have gotten (sender pretending to be from state DMV, post office, bank, credit card company, etc.) were by far the largest category by number reported (845,806 in 2024). Of those imposter reports, 22% involved actual losses ($800 median loss), totaling a hefty $2,952 million. That is a juicy enough haul to keep those robo frauds coming.

How to not get scammed: Be suspicious of every email or text, especially ones that prey on emotions like fear or greed or curiosity and try to engage you to payments or for prying information out of you. If it purports to come from some known entity like Bank of America or your state DMV, contact said entity directly to check it out. If you don’t click on anything (or reply in any way to the text, like responding with Y or N), it can’t hurt you.

I’m not sure how much they can do, considering the bad guys tend to hijack legit phone numbers for their dirty work, but you can mark these texts as spam to help your phone carrier improve their spam detection algorithm. Also, reporting scam texts to the U.S. Federal Trade Commission and/or the FBI’s Internet Crime Complaint Center can help build their data set, and perhaps lead to law enforcement actions.

Later add: According to EZPass, here is how to report text scams:

You can report smishing messages to your cell carrier by following this FCC guidance.  This service is provided by most cell carriers.

  1. Hold down the spam TXT/SMS message with your finger
  2. Select the “Forward” option
  3. Enter 7726 as the recipient and press “Send”

Additionally, to report the message to the FBI, visit the FBI’s Internet Crime Complaint Center (ic3.gov) and select ‘File a Complaint’ to do so.  When completing the complaint, include the phone number where the smishing text originated, and the website link listed within the text.

Study Shows AI Can Enable Information-Stealing (Phishing) Campaigns

Scott BuchananLeave a comment

As a computer user, I make a modest effort to stay informed regarding the latest maneuvers by the bad guys to steal information and money. I am on a mailing list for the Malwarebytes blog, which publishes maybe three or four stories a week in this arena.

Here are three stories from the latest Malwarebytes email:

 ( 1 )   AI-supported spear phishing fools more than 50% of targets A controlled study reveals that 54% of users were tricked by AI-supported spear phishing emails, compared to just 12% who were targeted by traditional, human-crafted ones. ( 2 )  Dental group lied through teeth about data breach, fined $350,000 Westend Dental denied a 2020 ransomware attack and associated data breach, telling its customers that their data was lost due to an “accidentally formatted hard drive”. The company agreed to pay $350,000 to settle HIPAA violations ( 3 ) “Can you try a game I made?” Fake game sites lead to information stealers Victims lured to a fake game website where they were met with an information stealer instead of the promised game.

The first item here fits with our interest in the promise and perils of AI, so I will paste a couple of self-explanatory excerpts in italics:

One of the first things everyone predicted when artificial intelligence (AI) became more commonplace was that it would assist cybercriminals in making their phishing campaigns more effective.

Now, researchers have conducted a scientific study into the effectiveness of AI supported spear phishing, and the results line up with everyone’s expectations: AI is making it easier to do crimes.

The study, titled Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects, evaluates the capability of large language models (LLMs) to conduct personalized phishing attacks and compares their performance with human experts and AI models from last year.

To this end the researchers developed and tested an AI-powered tool to automate spear phishing campaigns. They used AI agents based on GPT-4o and Claude 3.5 Sonnet to search the web for available information on a target and use this for highly personalized phishing messages.

With these tools, the researchers achieved a click-through rate (CTR) that marketing departments can only dream of, at 54%. The control group received arbitrary phishing emails and achieved a CTR of 12% (roughly 1 in 8 people clicked the link).

Another group was tested against an email generated by human experts which proved to be just as effective as the fully AI automated emails and got a 54% CTR. But the human experts did this at 30 times the cost of the AI automated tools.

…

…The key to the success of a phishing email is the level of personalization that can be achieved by the AI assisted method and the base for that personalization can be provided by an AI web-browsing agent that crawls publicly available information.

Based on information found online about the target, they are invited to participate in a project that aligns with their interest and presented with a link to a site where they can find more details.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

But there is good news as well. We can use AI to fight AI: … LLMs are also getting better at recognizing phishing emails. Claude 3.5 Sonnet scored well above 90% with only a few false alarms and detected several emails that passed human detection. Although it struggles with some phishing emails that are clearly suspicious to most humans.

In addition, the blog article cited some hard evidence for year-over-year progress in AI capabilities: a year ago, unassisted AI was unable to match the phishing performance of human-generated phishing messages. But now, AI can match and even slightly exceed the effectiveness of human phishing. This is….progress, I guess.

P.S. I’d feel remiss if I did not remind us all yet again, it’s safest to never click on a link embedded in an email message, if you can avoid it. If the email purports to be from a company, it’s safest to go directly to the company’s website and do your business there.