In the ever-evolving world of cybersecurity, it’s not uncommon for security researchers to be thrust into unexpected battles. For Grant Smith, a security researcher and founder of Phantom Security, the fight became personal when his wife fell victim to a sophisticated smishing scam. Posing as the United States Postal Service (USPS), the scammers managed to extract her credit card details through a fraudulent website. What began as a simple phishing attempt quickly escalated into an international investigation, uncovering a large-scale criminal operation and saving hundreds of thousands of people from falling prey to the same scam.

The Smishing Scam That Started It All

It all began with a seemingly innocent text message. Early this year, Smith and thousands of others received messages claiming that the USPS was attempting to deliver a package but needed additional information, including credit card details, to proceed. The texts directed recipients to various websites where they could input the requested information. The message was clear, urgent, and, for many, believable. However, it was all a ruse. For Smith, the scam hit home when his wife called, distressed after realizing she had entered her credit card details on one of these fraudulent sites. As a red team engineer with a background in offensive cybersecurity, Smith knew that he had to take action. What followed was a relentless pursuit of the scammers, driven not only by professional curiosity but by a personal vendetta against those who had tricked his wife.

Tracking Down the Scammers

Smith’s investigation led him deep into the digital underworld. Over several weeks, he managed to trace the origins of the smishing campaign to a group operating in China. The scale of the operation was staggering. The group had set up 1,133 domains, all designed to mimic legitimate USPS websites, and had duped victims into entering their credit card information. But Smith wasn’t content with merely identifying the culprits. Utilizing his skills as a hacker, he breached the scammers’ systems, gaining access to their databases. What he found was alarming: 438,669 unique credit card numbers had been entered into the scammers’ sites, along with more than 50,000 email addresses. The data included information from across the United States, with California being hit hardest, recording 141,000 entries. The operation was massive, affecting people from all walks of life, including those with military and government email addresses.

Collaborating with Authorities

With a treasure trove of evidence in hand, Smith began the painstaking process of compiling the data and reaching out to the appropriate authorities. He collaborated with USPS investigators and a major US bank, sharing his findings and ensuring that the compromised credit cards were protected from fraudulent activity. Smith’s efforts didn’t just stop at securing the data he had uncovered. He continued to work closely with law enforcement, providing insights into the scammers’ techniques and helping to dismantle the infrastructure they had built. While Smith’s actions prevented the immediate threat to 438,669 credit cards, he believes that the full scale of the operation is likely much larger. His investigation revealed connections to similar scams in at least six other countries, indicating that the group behind the USPS smishing campaign had a global reach.

The Bigger Picture

The success of Smith’s investigation highlights both the dangers of modern smishing attacks and the importance of vigilance in cybersecurity. As he prepares to present his findings at the Defcon security conference, Smith is eager to raise awareness about the sheer scale of these types of operations. “This shows the mass scale of the problem,” Smith says, pointing to the millions of pieces of information entered into the scammers’ databases. For every site Smith managed to shut down, countless others may still be active, continuing to prey on unsuspecting victims. Smith’s story is a stark reminder that even the most seemingly mundane text messages can be the gateway to a complex web of fraud. His actions demonstrate the power of individuals to fight back against cybercrime, using their skills not just to protect themselves but to shield countless others from harm. As the battle against cybercriminals continues, stories like Smith’s provide hope that with the right expertise and determination, even the most sophisticated scams can be thwarted.