A real-world text message scam uses the recipient’s real name followed by a question mark to trigger an automatic reply like “Who’s this?”. The goal is to get the victim to engage so the scammer can steer the conversation toward information theft or a longer con (including investment fraud), or at minimum confirm the number is “active” and responsive for future scams.
This scam strips smishing down to its simplest possible form. The text message contains nothing but the recipient's real name followed by a question mark, with no link, no company name, and no stated reason for contacting the person. That bare simplicity is the point. A message like this invites an almost automatic response such as "Yes?" or "Who's this?" because human curiosity and politeness push people to answer a question addressed directly to them by name.
Once the recipient replies, the scammer has what they actually wanted: proof the number is active and a person willing to engage. From there, documented paths include building rapport through a "wrong number" style exchange that later pivots into a pitch, including cryptocurrency investment fraud. Even if no further scam unfolds immediately, the reply itself has value, since the number can be reused or sold for future campaigns.
The attack works because it exploits a reasonable but flawed assumption: "They have my name and number, so this must be someone I know." In reality, name-and-phone-number combinations can come from breached data traded by cybercriminals, meaning a scammer doesn't need any real relationship with the target to make a message feel personal. The low sophistication of the message, just a name and a question mark, also means it slips past the usual red flags people watch for, like suspicious links or urgent demands for money.
The single most effective defense is also the simplest: don't reply. Sometimes the first thing a scammer is asking for is simply a reply, and even a dismissive response like "Who's this?" or "Wrong number" tells them the number is live and the person behind it is willing to engage.
Organizations can build resistance by training employees and family members to treat any unsolicited name-only text as a prompt for engagement rather than a genuine message from someone they know. If there's a real chance the sender is legitimate, the safer move is to contact that person through a number or channel already trusted, rather than continuing the conversation in the unknown thread. If a reply has already been sent, the advice is to stop engaging immediately. Finally, encourage people to report the message using their messaging app's reporting option before blocking the sender, since reporting helps flag the pattern for others.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The scam text contains only the recipient's real name followed by a question mark, with no link or other context, designed to trigger an almost automatic reply.
The goal is simply to get the recipient to engage, since any reply confirms the number is active and opens the door to later requests for money or personal information.
Name-and-phone-number combinations can come from breached data traded by cybercriminals, so knowing your name is not proof the sender actually knows you.
Don't reply, even with something like 'Who's this?' or 'Wrong number.' If you think it could be someone you know, contact them through a channel you already trust, and report the message before blocking the sender.
You get a text from an unknown number. It just says your name… and a question mark. This is a smishing setup. They use breached data so it feels personal, hoping you’ll reflex-reply with “Yes?” or “Who’s this?” so they can start a longer scam. Here’s the trick: the message has your real name, but zero context. No “Hi, it’s Alex from HR,” no reason they’re texting. That’s your red flag. If you get a one-word name-plus-question-mark text from an unknown number, don’t reply. Report it in your messaging app, then block.
The article describes how “wrong-number” SMS messages are used as a first-step social engineering test to identify people who will engage with strangers. If the target replies, scammers may either build a long relationship that leads to fake investment fraud (“pig butchering”) or recycle the…
ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…
Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
UK cyber authorities and international partners warned that Iranian state cyber actors have been tricking dissidents, activists, and journalists into installing spyware called CHOSEN BRICK. The campaign uses impersonation over messaging apps (such as WhatsApp and Telegram), rapport-building, and…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
