Scamwatch: how scammers sneak into your text messages

Our expert helps a reader targeted by a bank impersonation scam

Dear Which?,

I’ve recently been targeted by a sustained campaign of scam texts and phone calls. It started with a dodgy text appearing at the end of a chain of legitimate messages from Lloyds Bank. 

It claimed I would receive a further message asking me to confirm activity on my account. A follow-up text from a different number claimed a £110 transaction on Amazon had been declined. 

It said I needed to confirm whether it was me who had attempted it, or it would ‘decline future card payments’.

I noticed that the message contained the last four digits of a card number which was not mine, raising my suspicions. I then got a total of seven calls from an ‘0333’ number to both my mobile and landline, which I didn’t answer.

I called Lloyds directly on its fraud hotline (using the number on its website), and bank staff confirmed they had no fraud concerns regarding my account.

This attempt was foiled, but I’m frightened that the scammers had both my numbers, knew I was with Lloyds and could also send texts appearing to be from Lloyds.

Martin Nicholas


Faye Lipson, Which? senior researcher, says:

The ability to slide into legitimate message threads from banks and other trusted organisations is one of the most convincing tricks in any scammer’s arsenal. 

They use online ‘spoofing’ services to send text messages over the internet ‘from’ SMS short names (such as ‘Lloyds Bank’). 

When that fake ‘Lloyds Bank’ message arrives on your smartphone, the phone will automatically group it with any other messages from the same short name. It has no ability to discern who the true sender is. 

This means we must treat all messages claiming to be from banks or other trusted bodies with a degree of scepticism – as you rightly did.

It’s common for scammers to have some prior knowledge of us – such as where we bank – gleaned from data breaches and then traded on murkier sections of the internet.

You’re not alone, though: the vast majority of us will have had our data stolen at some point, often repeatedly.

That’s why, when we’re asked for our money or personal information, we should always take five minutes and think about how to verify what we’ve been told, using trusted contact details – such as the helpline number on the back of your card.

Find out more: