Malwarebytes Labs warns that replying to scam texts validates active numbers
Cybercriminals use brief, personalized texts to trick recipients into confirming their phone numbers are active and willing to engage.
Key points
- Replying to scam texts signals to attackers that a number is active and the user is willing to engage.
- Scammers use names from data breaches to make generic texts appear personal and legitimate.
- The FTC has warned about these brief messages as a tactic to initiate fraudulent conversations.
Malwarebytes Labs published research showing that scammers use simple texts containing a recipient’s name to trick people into replying. This engagement confirms the phone number is active and makes the target more valuable for future fraud campaigns.
The study highlights that even a harmless question like “Who’s this?” provides cybercriminals with useful data. According to Malwarebytes, any reply tells attackers the number is valid and the owner is willing to communicate, increasing the number’s resale value on the dark web.
The Mechanics of Engagement
The specific text example analyzed by Malwarebytes contained no links, payment demands, or fake images. It relied solely on the recipient’s name to create a sense of familiarity. This approach exploits the natural human tendency to answer when addressed directly by name.
Scammers do not need to make outrageous promises to start a conversation. The goal of the initial message is simply to get a response. Once a reply is received, the attacker knows the target is real and potentially vulnerable to further social engineering attempts.
The Federal Trade Commission has previously warned about these brief, seemingly innocuous messages. Regulators note that scammers use this low-effort tactic to filter out inactive numbers and identify victims who are polite enough to respond to unknown senders.
Who Is Affected
Anyone whose name and phone number have been exposed in data breaches is at risk. Malwarebytes explains that cybercriminals trade these details, allowing scammers to personalize messages without knowing the victim personally.
The research outlines a common progression for these scams. After establishing contact, the sender may build a friendly relationship over time. This trust-building phase can eventually lead to discussions about investment opportunities or other financial schemes.
The FBI has described how cryptocurrency investment scammers use unsolicited texts to approach victims. They focus on building trust before introducing fraudulent investments. This method relies on the initial engagement secured through simple text messages.
Even if the conversation does not lead to immediate financial loss, the initial reply harms the victim. The confirmed active number can be reused in other campaigns or sold to different criminal groups. This increases the volume of spam and scam messages the victim receives.
What should you do?
Malwarebytes advises users to never reply to suspicious texts, even to ask who the sender is. If a message appears to be from someone known, contact that person through a trusted channel or number already in your address book.
Users should report the message using their messaging app’s built-in tools before blocking the sender. This helps platforms identify and filter similar spam. If you have already replied, stop engaging immediately to minimize further exploitation.
Reviewing privacy settings on social media and messaging apps can also reduce exposure. Limiting who can see your profile photo, status, or phone number makes it harder for scammers to gather the personal details needed for these personalized attacks.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Malwarebytes
- Do not reply to unsolicited texts, even if they contain your name or seem to come from a known contact.
- Report suspicious numbers using your messaging app’s reporting feature before blocking the sender.
- Review and tighten privacy settings on social media and messaging platforms to limit visible personal data.
- Use tools to check if your personal information has been exposed in known data breaches.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is replying to a scam text dangerous?
Replying confirms to scammers that your number is active and that you are willing to engage, making you a higher-value target for future fraud.
How do scammers get my name and number?
They often obtain name-and-phone-number combinations from data breaches that are traded by cybercriminals on the dark web.
What should I do if I receive a suspicious text?
Do not reply. Report the message through your app’s reporting option, then block the sender. Contact known contacts through trusted channels.
