Phone scam? - contacts compromised?

donaghs

hi, a new variety of phone number spoofing maybe. Two members of my family got SMS text messages saying “call me” within about a minute. Both were in the same room, so were immediately suspicious.
i know there are free text services allowing people to text “call me” for free.
however, what happened next was different. One of them got a phone call from the others number. The other person was sitting there and was not calling.

The call was not answered. But, does this suggests that one of the persons contacts have been compromised?

If so, how? Perhaps an app that is granted permissions to contacts?

ItHurtsWhenIP

It's quite unlikely that anybody's device was compromised in this case.

It is trivial to "spoof" a number - i.e. make it appear that the other person is calling them. There are services out there that can do this.

You simply can no longer trust incoming calls, particularly those that are trying to get you to take some kind of action (transfer money, give over codes, PINs, etc.)

Here is an OLD clip showing it being used:

https://www.youtube.com/watch?v=LYilP-1TwMg

And here is an updated version … now with added AI:

https://youtu.be/U2r1MJk85Zo?si=Jdrn76facQtim9fU&t=486

donaghs

https://www.boards.ie/discussion/comment/122498696#Comment_122498696

Spoofing isn’t new. Usually (recently) it comes from random Irish numbers. But how could someone know the owners of the two numbers knew each other?

ItHurtsWhenIP

https://www.boards.ie/discussion/comment/122499026#Comment_122499026

Just like Spoofing isn't new, coincidences have been around for millennia or even longer. 👀

However data breaches have been around a couple of decades, so perhaps their numbers were associated in one of those.

If you put the numbers into:

https://haveibeenpwned.com/

in international format … i.e. +3538xyyyyyyy … if one or both numbers were in the Facebook breach from 2021, which affected 1.5m Irish people, then this could be the start of it. This breach was significant as it associated a phone number with an identity:

The two individuals could also try their email addresses on Have I Been Pwned and they may find other data breaches which could potentially connect them.

But my money is on coincidence.