The scams are sophisticated. Most of us by now have received text messages from seemingly trusted numbers, like cell service providers, banks, or even government agencies. Most recently, there are reports of texts pretending to come from the DPWH to provide financial assistance for flooding.

The texts look legitimate: points for your phone account or a chance to claim cash from your bank/credit card provider. Someone close to me got a text from her bank saying she earned enough points for an air-fryer; all she had to do was click a link and provide information.

And that’s how they get you.

But really, how do they get you? There’s something more complex going on. To answer, I interviewed Anton Bonifacio, Chief Information Security Officer and Chief AI Officer of Globe. He explains that while we can understand the modus operandi in spoofing numbers, it’s still very difficult to catch or prevent.

What the scammers do is they disconnect you from your actual cell service provider and shoot you into their network. They do this using a device called an IMSI Catcher. So without you knowing it, because your phone has come into contact with the signal from an IMSI Catcher, it has pulled you into their system.

Once inside, they move you from safer protocols that the networks run on, like 4G or 5G, and shoot you down to 2G. As Bonifacio explains, 2G is a weak protocol and leaves you vulnerable. From there, they can spoof anything.

One of the reasons the IMSI Catchers are so effective in undermining security is that they are actual physical devices that are difficult to track. Reported cases reveal two common ways that bad actors deploy IMSI Catchers to launch scams. First is they put the IMSI Catchers in vans, then they either drive around so that they can grab and send as much as they can in an area. Or they park in populated areas like near MRT Stations or malls, areas where there’s a lot of foot traffic so they can catch a large number of people to send texts to.

The second way is more mobile. There are smaller IMSI Catchers that can fit into backpacks, so the scammers will put one in a backpack, then have someone go in and out of condos wearing the backpack to grab signal and send texts.

Bonifacio explains that it might sound like just a small operation because it’s a guy driving around in a van or a guy with a device in the backpack. But unpack the many moving parts: how the IMSI Catcher was acquired or assembled, the people sending the texts, the network of people to receive texts from people who are fooled by the tactic, and then moving from victims providing information to utilizing that compromised information to access credit cards and accounts and commit the actual theft.

I ask, how is anyone supposed to defend themselves against what’s clearly a complex criminal operation?

Bonifacio points out that this is really beyond the ability of individuals or even Globe to handle on their own. Because this is a criminal enterprise, we do need law enforcement to step in and catch these scammers. But that’s easier said than done. They will need IMSI Scanner detectors, and these devices can cost around 45,000USD. And that’s just the start of it. Even if you had a scanner, you would need to establish a way for investigating and catching the culprits within large populated cities.

That’s why Bonifacio is quick to point out that this isn’t just a problem for us here in the Philippines, but it’s actually a global issue. It’s a modus operandi being deployed by criminal organizations in many countries.

For us as individuals, it’s still the same advice: even if it looks like a familiar number, if there’s a link don’t click. All cell service providers and almost all banks have already stopped sending links so you know that if there’s a link, it’s likely a scam.

We can’t solve this problem on our own, and the scammers are getting better at sending messages that might make us click. Taking advantage of people’s need, especially in pretending to be disaster relief, is particularly nefarious. Hopefully by understanding how spoofed numbers work, you can be a little better equipped against them.