Text message phishing scams, commonly known as smishing, are increasingly using accurate family titles and even the real names of victims' children to steal bank details and trick victims into installing malicious apps.

Scammers addressed older victims as "Mom" or "Dad" with near-perfect accuracy, and multiple cases involved the children's actual names. Authorities suspect the fraud relies on personal information exposed during recent massive data breaches.

A report on family imposter smishing released by Infinigru Corp., a Korean fraud-prevention technology company, found 1,856 victims received demands for money or personal information, or had their phones remotely accessed after installing an app, over the seven months from Dec. 8 last year to July 14. These victims received a combined 40,876 messages. The victims were predominantly older, with those aged 50 and above accounting for about 94 percent, or 1,743 people.

To deceive victims more easily, scammers used titles like "Mom" and "Dad" in messages claiming a broken phone screen or a changed contact number. Among 1,801 victims aged 40 and older, 1,718 were addressed accurately as "Mom" or "Dad," with a 95.3 percent accuracy rate.

Title accuracy increased with age. The rate was 79.2 percent for victims in their 40s, 93.2 percent for those in their 50s, 96 percent for those in their 60s, 97 percent for those in their 70s, and 96.2 percent for those aged 80 and older.

"Messages from a single scamming number was heavily concentrated on recipients in their 50s and older, and the title accuracy such as 'Mom' and 'Dad' approaches 100 percent," Infinigru said in its report. "Rather than sending messages randomly, this is suspected to be targeted smishing using age and gender information secured through recent personal data leaks."

Scammers even sent text messages using the real names of children to 30 victims, causing victims to drop their guard. Of those 30 victims, 29 exchanged two or more text messages with the scammers, and the median number of messages exchanged was 34, more than three times the overall sample median of 10. Eleven of those 30 victims installed a malicious app via a link, granting scammers remote access to their phones.

"When the real names of children were mentioned, it was not a case of scammers stealing personal information in real-time, but rather scammers repeatedly exploiting contact lists already leaked through past malicious app infections," Infinigru said.

Senders also identified themselves with labels like "I'm your firstborn" or "I'm your eldest son," terms common among Korean parents, presumably copied directly from contact names saved on the victims' phones.

Smishing messages surged starting in March. Monthly text volume rose from 1,291 in December, 2,410 in January and 2,137 in February to 10,162 in March and 10,791 in April, before dipping to 6,300 in May and 7,566 in June. Scammers focused their initial contact between 10 a.m. and 2 p.m.

"Scammers appear to target times when children are at work or school to make the situation of a broken phone sound plausible," the report said.

Victims suffered losses before they even realized they were being scammed. The median time from the first text message to a request for money or personal information was just 26 minutes. Scammers built trust by maintaining long conversations, with 1,994 of 2,525 reviewed exchanges lasting more than an hour.

The challenge remains to apprehend the scammers. Of the 1,160 phone numbers used to send the messages, 818 were used for only a single day before being discarded. Scammers used a rotating pool of phone numbers registered under stolen identities.

Lee Woong-hyuk, a professor of police science at Konkuk University, said a series of massive data breaches has increased the likelihood of scammers exploiting detailed personal information.

"People must not immediately trust texts or phone calls that mention personal details, and the government and corporations must strengthen security measures to solve the underlying problem," Lee said.

This article from the Hankook Ilbo, the sister publication of The Korea Times, is translated by a generative AI system and edited by The Korea Times.