CastleCops® - Beware 800-320-9807 is a Verizon VOIP Phish

The normal definition for a Vish or VOIP Phish is a dialer which has been set up on a VOIP line and is calling out to numbers in a given area. In this case the Vish was not a call that was made, but a text message which was sent to the phone. Wikipedia says VOIP Spam is "as-yet non-existent problem". Given what transpired today I tend to believe it is the next up and coming abuse in a wave of what is to come as technology grows.

Anyone who has a cell coverage through Verizon and gets text messages from Verizon knows the subject line of the message says: Free VZW MSG. When you see that you expect it has something to do with your account. I generally get a message when our bill is ready to be reviewed and also again to confirm payment has been received. When we get a txt message from Verizon, both Paul and I get it, as my phone is the secondary line on the account. Had he also gotten a message, I would not have checked my phone until much later, but since he didn't and the subject line made it appear to be from Verizon I was curious. I was very surprised to read I had exceeded our text messaging quota despite the fact that we have unlimited txt messaging in our package.

The following is the actual txt message I received on my phone:

From:900080003360
Free VZW MSG. U have exceeded ur TXT allowance. Have acct. holder call 2 day@ 800-320-9807 & increase ur messaging pkg 2 help u save. Rply Q 2 opt out.
Call:8003209807
4:55 pm 2/8/07

Red Flags:

1. When you get a text message from a Company, they don't generally text you in computereez shorthand.

2. If they want you to call back they will use a number which is actually registered to them. This number isn't listed in any state as belonging to Verizon.

So if you get a text message on your phone telling you to call because you are over limit, what do you do?

First you can look up toll free numbers which are supposed to be registered to major companies online. If it doesn't show up there, go ahead and call up the company. You will want to report the text message to them. Don't delete it. Deleting the text message is actually getting rid of evidence. The company will need the information from the text message to be able to file a complaint with the FBI. Keep the message (evidence) at least until after you talk to them, so you have it if they want you to forward it to them.

What you should not do is call the number back. It is possible, through social engineering techniques, for them to get other information out of you which they could exploit, even if you don't give them your credit card number. By calling them back you are also alerting them to the fact that your phone number works. VOIP Spam is no different then email spam, once they know there is someone on the other end, your address or in this case phone number will start to be circulated, thus opening you up to many more scams.

Update: While I was writing this article, Paul actually called the number and discovered there is a human being on the other end of the phone. We didn't want to ask anything because Verizon and Law Enforcement are looking into this, but we did take a recording of the person answering the phone which is attached here as wav file.

I also called Verizon Tech support and had them confirm that we do indeed have unlimited text messaging. They looked up the number in an effort to confirm whether or not it was a Verizon number and were unable to find a listing.

Note: Updated 7:16 PM EST


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 182ppm 0.969s (0.039s) Making cybercriminals unhappy since 2002*