Scammers wrested control of a state-backed text alert system to blast 166,000 fraudulent messages to New Yorkers, using their trust in official communication to try one of the oldest bank-account ruses around.
State technology officials confirmed the invasion after a vendor behind New York’s text notifications was breached, leading to an immediate investigation and an urgent warning to the public.
- How the vendor breach unfolded and enabled spam blasts
- Why this attack matters for governments and consumers
- The bigger trend in smishing and trusted sender abuse
- What the fraudulent messages said to lure victims
- What officials and the vendor are doing after the breach
- How New Yorkers can protect themselves from smishing scams
- The bottom line on the New York alert system breach
New York’s Office of Information Technology Services said some 188,000 residents were signed up for state SMS updates and that approximately 166,000 received the false texts. The episode illustrates how criminals are ramping up their efforts to conduct “smishing” campaigns through the abuse of legitimate messaging platforms, instead of banking only on random mass texts.
How the vendor breach unfolded and enabled spam blasts
The hacked supplier, Mobile Commons, hosts messaging infrastructure for government organizations and nonprofits. The company said an unauthorized actor accessed the data using a probable spear-phishing or another type of social engineering. The breach continued for some four hours, until it was detected and blocked shortly after midnight, according to a statement issued to national media.
During that time window, attackers made several spam blasts. A portion of those messages made their way to subscribers — including people who had signed up to receive alerts from New York state programs. Mobile Commons said there is no indication that subscriber data was exfiltrated, but the company declined to say how many of each client’s messages were received or read.
The scam was a simple but effective one: Targets were instructed to call a toll-free number regarding a declined high-value transaction. Those who called would likely be steered to “verify” accounts or transfer funds — social engineering meant to create urgency and extract money, while mimicking a bank’s fraud controls.
Why this attack matters for governments and consumers
Hijacking a trusted sender is the holy grail for text spammers. Official program messages are much more likely to be opened and the call to action heeded. This is a supply-chain-style incident: the target wasn’t one agency’s system but rather a shared communications vendor with multiple customers and an expanded blast radius across subscriber bases.
It also illuminates a painful truth for defenders. Carriers and platforms have stepped up filtering of obvious spam, and banks have piled on two-factor authentication. But when bad actors send from legitimate short codes or registered numbers within a true alert platform, standard reputation checks and keyword filters can be defeated — at least temporarily — until the abuse is identified.
The bigger trend in smishing and trusted sender abuse
Text scams have multiplied with the prevalence of mobile messaging. According to the Federal Trade Commission, texting is now the most frequent first point of contact for fraud victims — more so than phone calls and emails. The FBI’s Internet Crime Complaint Center is still cautioning that social engineering remains a potent force for consumer loss, whether it arrives over SMS, chat or phone.
Regulators have responded. The Federal Communications Commission is requiring carriers to block messages sent from numbers that are not valid, not allocated or not in use, and to disable ones sent by a valid number if that appears on a government do-not-originate list. IAB programs, such as those requiring application-to-person texting campaigns be registered, are intended to enhance accountability, but this occurrence indicates that rigorous vetting is only half of the answer and must be complemented with continuous oversight and fast reaction.
What the fraudulent messages said to lure victims
The fraudulent texts, which evolved over time but reached a peak in the summer and fall after more than 15 million claims had been submitted, referred to a denied transaction for a significant sum of money and directed recipients to call a hotline. Different iterations of this script are used to pretend as banks, delivery services or government authorities. The hook is psychological: urgency, high stakes and a simple action — pick up the phone now — to subvert rational analysis.
Experts say including a toll-free number can lend an air of legitimacy to messages. Another is that it steers victims from carrier-controlled messaging networks into phone calls, where attackers can think on their feet and apply pressure in the moment.
What officials and the vendor are doing after the breach
State technology officials say they responded to stop the malicious dispatches and are working with the vendor to gauge damage and toughen targeted systems. Mobile Commons says that it has sealed the spigot, conducted a forensic audit and implemented more controls. The company has said it doesn’t believe subscriber data was breached, but little other information has been offered — including how the attacker may have coaxed staff or contractors into providing unauthorized access (the so-called “phishing lure,” as well as additional information, remain under wraps).
How New Yorkers can protect themselves from smishing scams
If you’re curious about a “declined” transaction, issues with your package or an account hold, don’t call the numbers or tap the links found in text messages.
- Contact your bank or credit card company using the number on the back of your card or through their official app. If a text appears to be from a government program, cross-check it with the agency’s website or a known short code.
- Opt in to account alerts in your bank’s app; use multifactor authentication when available; and set transaction limits and push notifications.
- Report suspicious texts to your carrier (forward to 7726) and to the FTC. If money is lost, also contact local law enforcement and your bank promptly.
The bottom line on the New York alert system breach
This breach didn’t just spew spam out of official channels; it leveraged that credibility to add a few extra kilowatts to even an overactive scam. Though the window of exposure was short, the incident is a cautionary shot across the bow to any business that uses mass texting. And better phishing defenses, least-privilege controls and continuous monitoring at vendors are table stakes today. Healthy skepticism by consumers remains the best defense when reacting to any surprising financial alert, no matter how official it appears, experts say.
