By Kim Hart
Washington Post Staff Writer
Monday, March 10, 2008
The spam messages that have long plagued e-mail inboxes are now finding victims through a much more personal route: the cellphone.
Text messages are the latest tool for advertisers and scammers to target consumers. But unlike junk e-mail that can be deleted with the click of a button, text-message spam costs money for the person who receives it and chips away at the mobile phone's aura of privacy.
"It's so annoying because I get charged every time I get one," said Ryan Williams, 27, of Falls Church, who receives half a dozen spam messages on a daily basis. They ask him to download ring tones, visit questionable sites over his phone's Internet connection or urge him to subscribe to horoscopes or sports-score updates.
Williams downloaded a program that was supposed to block texts from numbers not stored in his phone's contact list, but the junk messages still get through. Spammers even make the messages appear as if they're coming from his own number, so his wireless carrier cannot block them.
"Spam e-mail usually goes right into my spam filter, but the texts are there, on my phone, and they just keep coming," he said.
More than 1 billion text messages are sent every day in the United States. U.S. consumers are expected to receive about 1.5 billion spam text messages this year, up from 1.1 billion last year and 800 million in 2006, according to Ferris Research, a San Francisco market research firm. Those are conservative figures; some estimates are far higher. Verizon Wireless said it blocks more than 200 million spam text messages every month, and cellphone companies are ramping up efforts to shut them out by taking spammers to court and by using more sophisticated filters.
Compared with spam e-mail, junk text messages are seen as more invasive because the cellphone is more intimate and is used for one-on-one communication -- a quality marketers are trying to utilize. Political campaigns and banks use text messages to mobilize voters or send account balance updates. Travel site Orbitz.com offers text-message updates on flight status. Television shows such as "American Idol" ask viewers to vote or take polls via text messages, and social networking sites like Facebook often use such notes to update members about friends' activities.
Spam is often a nuisance, but more malicious messages can lead to a new form of fraud called smishing, a variation of a spam e-mail attack known as phishing. Smishing attacks, called such because text messages are also known as SMS messages, disguise themselves as legitimate messages from e-commerce or financial sites such as eBay, PayPal or banks, and seek to dupe consumers into giving up account numbers or passwords.
Lori Small, a massage therapist in Ellicott City, fell for such a come-on. Her bank sends her a text message every time a transaction occurs on her checking account. In November, a message informed her that her account was overdrawn and asked her to provide the last four digits of her Social Security number to verify her ownership of the account. She sent the four digits to the sender.
After getting suspicious, she called her bank, which told her it did not send the message and that it has a policy of not asking for account details via cellphone. She changed her cellphone number and now closely monitors her balance for any mysterious changes.
"I couldn't believe how sneaky it was," she said. "I mean, e-mail spam is one thing, but this is my personal phone number . . . and now someone out there has one more clue about who I am."
Spam messages and smishing attacks are more prevalent in Asia, where consumers often use phones to access the Internet and are more accustomed to receiving mobile advertisements, said Richi Jennings, an analyst who studies spam issues for Ferris Research.
Spammers use similar techniques to target people through text messages as they do through e-mail. They harvest phone numbers from databases or hack into the records of legitimate companies that have permission to send text messages, such as travel sites or online retailers. The guesswork involved in targeting cellphone numbers is easier than randomly selecting e-mail addresses; while an e-mail address has a unique sequence of characters and a variable length, phone numbers are 10 digits. Therefore, it is easier to blitz thousands of potential customers at once.
Most text messages are sent without any form of encryption, allowing tech-savvy spammers to intercept the messages and get access to personal information, said Larry Ponemon, founder of the Ponemon Institute, a privacy and security research firm.
As of 2005, federal agencies banned companies from sending unsolicited commercial e-mail and text messages to mobile phones. To receive promotional material or updates, consumers typically must text a message to a short code to opt in to the service.
But Simeon Coney, marketing director at anti-spam software maker AdaptiveMobile, said spammers are breaking the law, bombarding cellphone users with unwanted mail that could infect phones and BlackBerrys with viruses.
Consumer complaints about text-message spam have been sporadic, according to the Federal Trade Commission, the FBI and Consumers Union. But Coney said his firm is starting to see "overall increases in mobile-spam traffic."
Last year, Verizon Wireless sued telemarketers it said inundated its networks with more than 12 million unsolicited commercial text messages. In its lawsuit, the wireless carrier said it was able to block all but 4,618. Customers were hit with unwanted charges and the spam slowed legitimate traffic, according to Verizon Wireless.
Individuals have also taken legal action against unwanted messages they perceive as spam. In October, Lindsey Abrams of Illinois filed a complaint against Facebook for sending "unauthorized text messages" to her wireless phone number, which had previously been assigned to another Facebook member. "These messages can come during all times of the day or night and, because the senders are often hard to identify, can be seen as intimidating or unsettling," Abrams said in the complaint.
In 2006, Lei Shen, also of Illinois, sued District-based mobile marketing company Distributive Networks for sending her unauthorized ads in the form of text messages.
Nearly a quarter of U.S. mobile subscribers say they've viewed a mobile advertisement in the last month, and more than half of them responded to it by sending a text message, clicking on it or calling a specific number, according to a report released last week by Nielsen Mobile.
A separate survey conducted by M:Metrics, a Seattle firm that tracks mobile trends, found that 28 percent of the people who get text-message ads did not give permission to receive them, up from 19.5 percent eight months ago.
The rise of spam could spoil trust in text messaging as a mode of communication, not to mention its potential for mobile advertising, according to Charles R. Taylor, a Villanova University marketing professor who has studied online and mobile ads. "Trust is crucial for an ad to be effective, and the minute you start clogging up cellphones and BlackBerrys, it's a real turn-off and an invasion of your personal space."
The revenue generated by data services, such as text messages, has grown along with the consumer demand. About 20 percent of wireless carriers' total revenue now comes from the delivery of text messages, said Roger Entner, senior vice president for the communications sector for IAG Research. Each text message typically costs between 10 and 20 cents, although the four largest U.S. carriers -- AT&T, Verizon Wireless, Sprint Nextel and T-Mobile -- are rolling out flat-rate plans for text messaging. The carriers said they have rigorous filters to block spam, and they allow customers to block messages from certain numbers. They also try to remove charges for unsolicited spam.
"We have every incentive to stop spam texts from getting through, since we end up footing the bill for a lot of it," said Verizon Wireless spokesman Jeffrey Nelson. "The longer a service like text is out there, the bigger the bulls'-eye gets."
Staff researcher Richard Drezen contributed to this report.
View all comments that have been posted about this article.