What’s the deal with these “you won something” texts?

I recently received a text message saying an iPhone 6s is waiting for me. I normally delete these messages, but this time I was curious… I have been considering upgrading from my iPhone 5 for a while now J. So, I decided to consult with my friend, Avast senior malware analyst Jan Sirmer and see what would happen if I believed the text.

How did they get my number?

The first question I had about this was: How did they get my number? “A computer probably sent it to you,” said Jan. How did a computer get my number? “There are programs that allow computers to send text messages to a bunch of numbers at once. They probably use the same area code and the rest of the digits in the number are generated by the program.”

What happens if you open the link in the text?

I dared myself to open the link on my phone and the first page prompted me, the lucky winner, to enter my data. Looks like I am just a few clicks away from claiming my new iPhone!

The next page said “Congratulations! Your new iPhone 6S total worth $1,000” and below the image of “my” new iPhone 6s I was asked to enter my name (first and last) and my email address. There was also a box with terms and conditions.

A closer look at the terms and conditions

The terms and conditions stated that if I won I could be contacted via the above entered email address. The bright green button you see in the image to the right also says “Participate for free”, so clearly I didn’t actually win the iPhone yet, like the text lead me to believe.

The terms and conditions continue to state that Esteo Ads d.o.o and their sponsors and partners can use my information for market research and for target group and customer profile analysis, as well as for promotional offers that meet my interests, from different sectors and organizations (for example non-profit organizations) by email, telephone, SMS and mail. Esteo Ads d.o.o. can also pass on my information to their partners and sponsors.

The word “sponsors” is hyperlinked and when I opened it I found that the list includes 39 sponsors that could either email or call me about offers. All of the sponsors had a check mark by default, which is for “yes, I am interested in receiving exciting offers”. The word “partners” is also hyperlinked and there are eight sponsors who could, also by default, email or call me about “exciting” offers.

The terms continue to say that these customers can send me free product samples. The terms and conditions say I can also participate in the lottery without accepting the terms and conditions by sending a postcard with the term “your-win” – but there is no address listed where someone can send the postcard to! Participants can revoke their consent, but there are no instructions listed on how this can be done.

Important for your participation

After entering my name, email address and accepting the terms and conditions I was asked to enter my date of birth and home address, so they have an address to mail my new iPhone to, and home address and mobile number (in case my doorbell is broken when the postal worker comes to deliver my iPhone or in case I am not home when they come? But most likely they need this so their sponsors can bombard me with calls about offers).

Next came a page with a red, dotted-line, outlined box with red text in it saying they have emailed me important information to wrap up my participation in the contest and to receive my free present. How exciting!

So many questions!

To raise my winning chances, which I was eager to do, I had the option to answer some random questions that ranged from “Are you interested in receiving information about supplementary dental insurance” to “Do you own a dog?”.

These questions may seem random to you and me and probably do nothing to better my chances of winning an iPhone (I don’t think anything in this universe will). However, they probably will help Esteo Ads d.o.o. make some money. Esteo Ads d.o.o., according to their terms and conditions, can share my personal information with their sponsors and partners, presumably so they can in turn send me their offers. My answers to the random questions will probably also be passed onto these sponsors and partners and they can then see if I belong to their target group, based on my answers to the random questions.

The important email

After answering the questions, I checked my email to finish up the process. The email said that in order to confirm my free participation in the contest I had to click on the confirmation link.

The confirmation link told me “You did it!” and wished me luck.

But the story does not end there. It really seemed to be my lucky day, there were more offers and discounts on the confirmation page!

I clicked on the O2 “No base fee” offer, which brought me to the page in the below image:

The URL says iLead.iTrack.it – which means they could be making more profit by being an affiliate partner of O2.

Sorry, no free iPhones for Avast users

I hate to break it to you, but this offer is a scam and the participation in this “contest” is also not free – you pay in giving away your personal data. I am deeply disappointed too. I will have to continue adding change to my piggy bank to save up to buy myself a new iPhone.

If this were a program or app, Avast would detect it as a potentially unwanted program (PUP). PUPs typically don’t spread malware, but they either take actions or use social engineering to trick people into taking actions they probably wouldn’t appreciate or want if they realized what was really going on. As this is a website, Avast cannot detect it as potentially unwanted and has, therefore, detects it as malware.

The people behind this scam use social engineering to trick people into falling for their scam. The text message was the first step, some people who receive text messages like this may believe they won an iPhone or a gift card (don’t judge). They are then tricked into following a link and entering in personal information only for people like Esteo Ads d.o.o. to profit by selling their information for others to then send ads to these innocent people.

This scam is also a perfect example how iPhone users are not completely immune. Since it is extremely difficult to slip malware into the App Store, malware authors and scammers need to rely on social engineering like this scam to target iOS users.

Tips to staying safe:

1. Be suspicious of text messages with offers that seem too good to be true – they are most likely are too good to be true!
2. Always read the fine print to be fully aware of who you are giving your personal data to
3. If you are an Android user, download Avast Mobile Security and make sure you protect your Mac and PC with Avast, too