ScamLens

Estafas por SMS y Llamadas Telefonicas (Smishing/Vishing)

Las estafas de smishing (phishing por SMS) y vishing (phishing por voz) usan mensajes de texto y llamadas telefonicas para enganar a las victimas y que revelen informacion personal, hagan clic en enlaces maliciosos o realicen pagos.

Tacticas Comunes

  • Fake package delivery notifications from USPS, FedEx, UPS, or Amazon containing malicious links to tracking pages that steal personal and financial information
  • Fake toll road violation texts (E-ZPass, SunPass, TxTag) claiming an unpaid toll and threatening a fine, directing victims to a phishing payment page — this scam saw a 900% increase in early 2025
  • Bank fraud alert texts claiming suspicious activity on the victim's account, with a link to a fake banking portal or a phone number connecting to a scammer posing as the fraud department
  • AI voice cloning scams where criminals use a few seconds of audio from social media to clone a family member's voice, then call claiming to be in an emergency (kidnapping, car accident, jail) and begging for immediate wire transfer
  • Robocall scams using spoofed caller IDs displaying local area codes or even the victim's own phone number to increase the likelihood the call is answered
  • Fake two-factor authentication texts that appear to come from legitimate services, asking the victim to "verify" a code — in reality, the scammer is logging into the victim's account and needs the real 2FA code

Como Identificarla

  • Legitimate companies rarely send text messages with links — if a delivery notification includes a link, go directly to the carrier's official website or app instead of clicking it
  • Toll road agencies send physical bills by mail and do not demand payment via text with threatening language about immediate fines
  • The text or call creates extreme urgency — "your account will be locked in 1 hour," "pay now or face legal action" — designed to prevent you from thinking clearly
  • AI-cloned family emergency calls may sound convincing but the caller avoids answering specific personal questions that only the real person would know
  • The phone number displayed on caller ID can be spoofed easily — a call appearing to come from your bank's real number does not guarantee it is actually your bank
  • Texts arriving from email addresses or unusually long phone numbers (e.g., 10+ digits) are almost always scam messages sent through internet gateways

Como Protegerte

  • Never click links in unexpected text messages — manually navigate to the company's official website or app to verify any claims about your account, deliveries, or toll violations
  • Establish a family code word that can be used to verify identity during emergency phone calls, defeating AI voice cloning attacks
  • If you receive a suspicious call claiming to be from your bank, hang up and call the number printed on the back of your debit or credit card
  • Register your phone number with the National Do Not Call Registry (donotcall.gov) and use your phone's built-in spam call filtering or a reputable call-blocking app
  • Never provide two-factor authentication codes to anyone who calls or texts you — legitimate services will never ask you to read these codes to another person
  • If you receive an urgent call from a family member asking for money, hang up and call that person directly on their known phone number to verify before sending anything

Ejemplos Reales

In the United States, a fake E-ZPass text stated "You have an unpaid toll of $6.99 — pay within 24 hours to avoid a $50 late fee" with a phishing link that harvested credit card details — the FBI issued a nationwide warning after a 900% increase in these toll road scams.

In the UK, smishing texts impersonated Royal Mail claiming a parcel could not be delivered and a small redelivery fee of £1.99 was required — the link led to a convincing Royal Mail replica that captured full banking credentials and home addresses.

In Australia, an AI voice cloning scam targeted a grandmother with a phone call from someone who sounded exactly like her grandson, crying and saying he had been in a car accident in Melbourne and needed AUD 12,000 wired immediately for bail — the real grandson was safe at university.

In India, bulk SMS messages impersonated ICICI Bank and HDFC Bank, claiming the recipient's account had been frozen due to KYC non-compliance — the link directed victims to a fake banking portal that harvested net banking credentials, Aadhaar numbers, and OTPs.

In Thailand, scam calls using spoofed Royal Thai Police numbers told victims their national ID had been linked to drug trafficking, pressuring them to transfer savings via PromptPay to a "government safe account" — the Bank of Thailand issued emergency warnings.

In Mexico, fraudulent Telcel and Telmex SMS messages warned of imminent service disconnection, directing victims to a fake payment portal that collected banking credentials and CLABE account numbers — the scam surged during holiday periods when people were more likely to pay quickly.

Verificar un Sitio Web Sospechoso