How Can Scam Texts Appear Under Official Sender Names?

(SPOT.ph) You probably know by now not to trust random texts from unknown numbers, but what if the scam message appears to come from your bank, telco, or other trusted companies you actually use? Actually, scratch the “what if.” We’re way past that point—how are they doing that at all?

One way scammers can pull this off involves equipment known as an IMSI catcher, which can essentially pretend to be a cell tower. Last August, the National Bureau of Investigation (NBI) seized two suspected IMSI catchers in Imus, Cavite. In another case, a former POGO guard was even caught allegedly trying to sell these devices on social media for P600,000.

So how can a fake cell tower send a scam text to your phone?

Also read: Got an Invite to Do Basic Work for Cash? It Could Be a Task Scam, PNP Warns

Under normal circumstances, your phone connects to legitimate base stations that are operated by your telco. An active IMSI catcher can imitate one of those towers by broadcasting a signal that convinces nearby phones to connect to it instead.

According to Globe, some of these devices can also force phones to downgrade to 2G, an older network with weaker security. Every text also comes with information telling your phone who supposedly sent it. Because the scammer is sending the message through the fake tower, they can replace that information with the name of a bank, telco, e-wallet, or another company you recognize.

That’s how a scam text can appear under an official sender name—and, in some cases, even end up in your existing text history with the real company. One victim interviewed by the Philippine Center for Investigative Journalism (PCIJ) said she trusted a fake rewards message precisely because it appeared alongside genuine messages from her bank.

And because the message is being sent through the fake tower instead of the telco’s usual messaging system, it can also bypass some of the spam filters that would normally screen messages.

Just to be clear: receiving one of these texts doesn’t mean the scammer suddenly has access to your passwords, banking apps, or everything else stored on your phone.

The scam still usually depends on what happens next. The message might warn about an unauthorized transaction, offer a too-good-to-be-true reward, or even prey on people in vulnerable situations—like a fake SSS Calamity Loan as seen in the message from "GCash" below.

Whatever the hook, the goal is the same: to get you to click a phishing link, enter your login or card details, provide an OTP, or hand over other sensitive information.

Unfortunately, probably not.

The Electronic Frontier Foundation noted that it can be difficult for ordinary users to tell whether their phone has connected to an active cell-site simulator. Even apps designed to detect them may not always be reliable.

A sudden drop from 4G or 5G to 2G before a suspicious text arrives can be one clue, but that isn't always proof that an IMSI catcher is nearby—your signal can change for perfectly normal reasons, too. By the time you notice the message, your phone may already have switched back to a real tower.

So rather than trying to figure out whether you were connected to an IMSI catcher, it’s better to treat any suspicious text with caution—even if the sender name looks legit.

Also read: That Traffic Violation Text Is a Phishing Scam, LTO Says