Web3 Security Alert – SMS Spoofing
Overview
● This article explains the mechanics of SMS spoofing and how it's being used in phishing attacks targeting Bitget users. It details how scammers fake sender identities and exploit human psychology to carry out their scams.
● It also outlines Bitget's security measures, including cooling-off periods, official verification channels, and two-factor authentication (2FA) to safeguard user accounts.
● Lastly, it provides best practices for users to enhance account security, such as installing antivirus software, avoiding suspicious links, and managing sensitive information across platforms.
Recently, we've observed a rise in phishing tactics in certain countries and regions where scammers forge official SMS messages that seamlessly blend into legitimate conversations between users and the Bitget platform, making them extremely hard to detect. A wave of phishing attacks targeting Bitget users has exploited this flaw — fake SMS appears in the same chat thread as official ones, often using identical sender IDs, thereby posing a significant security risk.
As smartphones become essential for both work and personal life, cybercrime targeting mobile devices is also on the rise. Since text messaging is one of the most common smartphone features, SMS-based phishing has become a particularly stealthy threat. Let's break down how SMS spoofing works.
What is SMS spoofing?
SMS spoofing is a type of cyber fraud in which attackers forge the sender's phone number or sender ID. When messages are received, the smartphone groups them under existing threads based on the sender's information — tricking victims into believing the messages are from a trusted source (like a bank, a friend, or an official institution). Scammers use this disguise to lure victims into revealing personal information, clicking malicious links, downloading malware, or even transferring funds — resulting in fraud or data theft.
How it works
● Fake sender identity: Attackers can impersonate any number, such as Bitget, government agencies, or even personal contacts, making the message look highly credible.
● Disguised intent: Messages are usually framed as urgent notices, security alerts, or important updates to lower the victim’s guard.
● Targeted attacks: Messages often mimic notifications from specific platforms (like crypto exchanges), creating confusion and misleading users.
Common scenarios
● Phishing attack: Trick users into clicking fake links that lead to phishing sites stealing account credentials.
● Impersonation scams: Pretend to be friends, institutions, or customer service reps to request money transfers.
● Malware delivery: Embed malicious code or links in SMS to infect the user's device.
Underlying principle
Regardless of the scenario, the core of SMS spoofing attacks lies in deception and manipulation. By pretending to be someone the user trusts, scammers are more likely to succeed. These attacks often involve social engineering—manipulating human emotions and behavior to trap victims. Here's how they set traps:
● Trust exploitation: Cybercriminals pose as legitimate entities or credible identities (Bitget support, affiliates, friends, and KOLs), banking on our instinct to trust familiar names. Since SMS is perceived as private, users are more likely to believe the information without questioning it.
● Contextual relevance: Scammers tailor messages to match situations that make sense, like pretending to send a withdrawal alert from your Bitget account. Because SMS is typically used for important updates, recipients are less likely to doubt its authenticity right away, making them more susceptible to the attacker's trap.
● Emotional manipulation: By creating urgency (e.g., "abnormal account activity" or "verify now"), or tapping into fear, curiosity, or anxiety, scammers override rational judgment. Victims are pushed into rash decisions—clicking links, entering passwords, or submitting 2FA codes. This emotional interference is the key to success.
Technical principles
● Sender ID spoofing: Scammers use malicious software or scripts to fake the sender's number and send SMS directly to your phone.
● VoIP services: Voice over Internet Protocol (VoIP) services let attackers set any sender name or number. For example, they can spoof Bitget's official customer service number so that fake messages appear within your legitimate Bitget SMS thread. When these fake SMS messages are sent to your phone, they may appear directly in your normal SMS conversation with Bitget, misleading you into thinking it's an official alert.
● SMS gateways: Attackers may rent or hijack rogue SMS gateways, or collude with shady service providers, to send fake messages that appear to come from Bitget.
Bitget security protections
Bitget is committed to keeping you a step ahead and fully informed about what's happening on your account.
Email alerts
If you have linked your email, you will receive an email whenever you log in from a new device. These emails include your anti-phishing code, verification code, login location, IP address, and device details. Always take a moment to verify that this information matches your activity.
If your account is accessed from a different location, you'll receive a follow-up email notifying you of the login. Please verify this access.
When making a withdrawal, you'll receive an email containing the verification code and full transaction details. Always confirm that everything matches your intended withdrawal.
Cooling-off period (1 hour or 24 hours)
To prevent impulsive actions caused by scams, Bitget has implemented a cooling-off period — a temporary safeguard triggered when the system detects potential account risks (like unusual login locations, suspicious transactions, or suspected fraud):
Cooling-off period: Depending on the risk level (1 hour or 24 hours).
● 1-hour period: For lower-risk scenarios (e.g., remote logins), this short delay pauses withdrawals so users can verify account activity.
● 24-hour period: For high-risk scenarios (e.g., verification method changes or phishing risks), all withdrawals are suspended, giving users time to reassess account safety.
Official verification channels
If you're unsure about someone's identity, you can always verify it through Bitget's official verification channel .
Best practices for account security
Enable multiple 2FA methods
Two-factor authentication (2FA) is a critical layer of protection that requires two separate methods of identity verification. This may include combinations of email, passwords, SMS, Google Authenticator, security keys, or other methods. Using multiple 2FA options greatly strengthens your account security and reliability.
Set anti-phishing code
An anti-phishing code is a security feature provided by Bitget to help users identify phishing websites. Once enabled, all official emails and SMS from Bitget (excluding SMS verification codes) will include your unique anti-phishing code. Phishing emails and SMS will not contain anti-phishing codes, making it easy for users to identify whether they are from official Bitget channels.
To set it up, go to Profile > Security > Anti-phishing code and follow the instructions.
Visit this link for more details about anti-phishing codes.
Enable withdrawal address confirmation
When withdrawing funds via the Bitget website, there's a risk of malicious activities like traffic hijacking, which may tamper with your withdrawal address. To prevent this, Bitget offers a cross-device verification switch. You'll be required to scan a QR code using the Bitget mobile app to confirm the withdrawal address before the request can go through.
Practice good account hygiene
Install antivirus software. Always download applications and software from trusted official sources, and avoid clicking on links received via SMS. To further enhance your account security, consider using a dedicated device for accessing sensitive or confidential accounts. Never put all your eggs in one basket. Avoid logging into your email, inserting a SIM card, and storing Google Authenticator on the same phone. If your device is lost or compromised, having everything on a single device could mean losing it all. Spreading out your risk can significantly reduce potential losses.
Conclusion: Security begins with awareness — and it starts with you
Technology can build defenses in the field of network security, but your awareness and vigilance are the ultimate safeguards. Scammers thrive on confusion and urgency, but when you're informed, you can spot the traps and respond with confidence. Bitget provides a multi-layered security framework to protect users, but the most powerful safeguard is your own understanding of risk. Every bit of scam awareness you gain is another shield protecting your assets.
Knowledge is power. Action is protection. Bitget will continue to update anti-scam resources and risk alerts. Every time you double-check a detail or make a cautious decision, you close the door on scammers. Let's work together to make safety our shared foundation.
Learn more: Bitget's security best practices
Related articles:
Web3 Security Alert - SMS Spoofing
Web3 Security Alert - Payzero
Web3 Security Alert - High-risk Tokens
Web3 Security Alert - Fake Apps
Web3 Security Alert - Malicious Approvals
