How we handle a firewall ticket (seven steps)
- Triage — client, severity, reply < 30 min. (Sev 1 = firewall bypass; most tickets are Sev 3.)
- Collect examples — number, time, sender ID, message ID.
- Check the firewall — action, rule, details, text.
- Compare — what works vs what fails.
- Recognise the case — sender ID, content, speed, fraud…
- Fix or explain — fix it, or explain why nothing changes (never reveal internal rules).
- Reply, verify, close — with fresh examples or a test first.
Where to look / what to compare: the firewall action and which rule stopped it; the details (sender ID, country/operator, time); the message text (link? scam?). Then compare a message that works with one that fails — the difference (new sender name, a shortener/new domain, a big campaign all at once) usually tells you the case.
The six common cases
Case 1 — Look-alike name in another alphabet. A scammer types "NovаBank" with one Cyrillic "а". The brand check sees "not the protected name" and passes; the user sees "NovaBank" and clicks. In the firewall: the sender ID mixes two alphabets (Latin + Cyrillic), the link starts with xn-- (a hidden non-Latin/punycode domain), the name is almost identical to a protected brand. We do: block sender IDs that mix alphabets; add look-alike versions to the protected list.
Case 2 — "Call this number" (premium-rate scam). "We missed your delivery, call +882…". No link at all; the victim calls an expensive international premium number and the number's operator shares the revenue with the scammer. In the firewall: a premium-rate international number in the text, the same text to many numbers, no link (so link checks miss it). We do: block the text pattern and the number ranges; inform the operator.
Case 3 — IMSI harvesting. One source asks "where is +385 91…?" thousands of times; the network answers IMSI + serving network; no SMS is ever sent — the answer was the goal. In the firewall: many "where is this number?" requests from one source, no real SMS follows, numbers asked one after another. We do: block the source; the network answers with a fake IMSI instead of the real one (home routing).
Case 4 — Bypassing the route with numeric senders. A company sends OTPs; someone in the chain switches the route to send them from ordinary mobile numbers so it looks like P2P and pays the cheap price — the operator loses A2P revenue. In the firewall: a private number sends the same template to thousands, business content (codes, orders) from a private number, the sending numbers keep changing. We do: block that route; force traffic onto the official A2P route with a brand sender ID.
Case 5 — SIM farms. Hundreds of SIMs in one box on a computer; each SIM sends a little to stay under the limits; blocked SIMs are replaced. In the firewall: a SIM sends thousands but never receives any, it never moves (same location), new SIMs appear as old ones are blocked. We do: block the SIMs and report the numbers; the operator shuts them down.
Case 6 — AIT (Artificially Inflated Traffic). Bots request OTPs on the client's sign-up page; 40,000 OTPs overnight, numbers in a row, only ~2% used; the numbers belong to a small operator who shares the money with the fraudster. In the firewall: a sudden OTP spike, numbers in a row in one small country, almost nobody types the code in. We do: stop the traffic and alert the client; suggest a per-number limit and a CAPTCHA.
Six real-world incidents
- Twitter fake 2FA (AIT), 2022–23. Musk claimed ~$60M/year lost to bots requesting SMS; ~390 telcos named; Twitter then limited SMS 2FA to paying users. → Case 6 at huge scale; velocity checks + fast client alerts matter.
- FluBot (Europe, 2021–22). Fake "your parcel is waiting" SMS with a malicious Android app that steals bank logins and reads SMS codes, then spreads to contacts; 60,000+ phones infected in Spain alone. → Fake brand + bad link; the firewall blocks bad links and unauthorised IDs.
- Smishing-as-a-service: fake toll texts (USA, 2024–25). "Smishing Triad" sold ~$8 per 1,000 scam texts; fake E-ZPass toll pages steal card details at industrial scale. → Scam SMS is cheap and industrial; content and link checks matter, not only sender IDs.
- Germany 2017: bank accounts emptied via SS7. Phishing/malware gave attackers banking passwords + phone numbers; via a foreign operator's SS7 access they redirected the victims' incoming SMS and stole the bank's mTAN codes at night. Confirmed by O2 Telefónica — the first publicly confirmed attack of this kind in Europe. → SMS was built on operator trust; the signalling side needs protection too.
- Simjacker (2019). An SMS with hidden commands runs on the old S@T Browser on the SIM and sends back location + IMEI — completely silent, nothing in the inbox. 1B+ phones potentially exposed; used by a surveillance firm for 2+ years. → An SMS can carry commands, not just text; the firewall can recognise and block that format.
- SMS blasters (2025–26). A fake tower in a car broadcasts a stronger signal; nearby phones connect and receive scam SMS that never touch the operator's network (arrests in London and Toronto; also Thailand, Vietnam, Greece). → No SMS firewall can see these; the firewall is one layer, not the only protection.
What the firewall can and can't stop
| Threat | Seen in | SMS firewall |
|---|---|---|
| Look-alike names / fake brands | Case 1, FluBot | Stops |
| Scam content, also without links | Case 2, toll texts | Stops |
| IMSI harvesting | Case 3, Germany 2017 | Stops |
| Route bypass / SIM farms | Cases 4–5 | Stops |
| AIT / SMS pumping | Case 6, Twitter | Stops |
| Binary SIM-command SMS | Simjacker | Stops* (if the operator filters that message type) |
| SMS blasters / malware on the phone | London, Toronto, FluBot | Can't see it |
Golden rules / takeaways
- SMS was built on trust — the firewall adds the checkpoint.
- Six cases — behind almost all of them is money.
- Every ticket: triage → examples → firewall → compare → fix → reply.
- The threats are real and big, but the firewall is one layer, not all of it.
Remember this (Module 6): Work every ticket the same way (triage → examples → firewall → compare → recognise → fix/explain → close). The six cases are look-alikes, premium-call, IMSI harvesting, route bypass, SIM farms and AIT — all about money. Real incidents map onto these cases. The firewall stops content/sender/route/volume fraud, but not a fake tower (SMS blaster) or malware already on the phone.