'Verifying' fake accounts via SMS cheaper than your coffee

 

Many online services rely on SMS codes for registration to deter “fake” accounts. However, a thriving grey market allows users to bypass these security measures for a small fee.

A year-long study by Cambridge University researchers has shed light on the online marketplace, where vendors buy SIM cards in bulk to sell verification services. As of Dec 23, verifying a Malaysian account averaged just US$0.40 (RM1.62).

The actual price varies depending on the service, demand, and the SIM card used. For instance, a Lalamove verification with a Malaysian SIM card costs US$0.80 (RM3.25), while Discord is only US$0.01 (RM0.04).

Verification services for popular social media and messaging services costs US$0.18 (RM0.73) for Facebook, US$0.13 (RM0.53) for TikTok, US$0.05 (RM0.20) for YouTube/Google, US$0.08 (RM0.32) for WeChat, US$0.66 (RM2.68) for Telegram, US$0.05 (RM0.20) for X (formerly known as Twitter), and US$1.42 (RM5.77) for WhatsApp.

The data, published on the Cambridge Online Trust & Safety Index website, or Costi, covers over 500 services across 197 countries and territories.

A paper describing the study and its findings was published in the journal Science on Dec 11. Malaysiakini has contacted the paper’s authors for more information.

SIMs for fraud and political manipulation

In Malaysia alone, vendors tracked by Costi offer over 1.7 million fake SMS verifications.

While there are legitimate uses like bypassing censorship and conducting open-source research, one of the paper’s authors, Jon Roozenbeek, told News From Science that “these companies don’t exist for that purpose”.

Instead, the researchers said these companies primarily facilitate manipulation and fraud.

This includes inflating social media engagement metrics, promoting cryptocurrency scams, and running political influence operations using inauthentic accounts.

Vendors buy physical or virtual SIM cards in bulk, and then offer the associated phone numbers for account verification.

Their customers can use the service to bypass verification checks and set up fake accounts en masse, especially if there are no other checks to confirm whether the new account being registered is genuine.

Since each SIM card can generally be used to verify a particular service only once, this creates a market dynamic of supply and demand that influences the price.

The prices vary widely depending on the service and the SIM card’s country of origin, and fluctuate based on demand and availability of the limited pool of phone numbers.

These prices and inventory numbers are often openly displayed by the vendors, and some even claim high success rates to charge a premium for the supposed reliability.

Price surge ahead of elections

After tracking the price data for a year, researchers found that verifications are pricier when using SIM cards from countries where they are more expensive or difficult to obtain.

An example is Japan, where the price of a physical SIM card is high, and proof of residency is required; or Türkiye, where SIM cards are cheap, but the registration process is complex and links the phone number to passports.

Meanwhile, the price for verifying a fake WhatsApp or Telegram account surges in the lead-up to national elections, suggesting an increased demand for registering fake accounts for political influence operations.

There was no such surge for other social media and messaging services.

This may be because it is easy to register a fake account in another country where it is potentially cheaper, and then post about events in a different country, the researchers wrote.

They noted that on the unaffected platforms, an account’s country of registration is not readily visible to other users.

“Messaging apps, however, make it easy to see where an account is from, thus incentivising the registration of local (inauthentic) accounts,” they said.

Making fake verifications harder

The researchers suggest that online platforms should consider making the country of registration of accounts more transparent to other users, to deter arbitrage and incentivise the use of local SIMs.

Search engines can also make such services harder to find by making them less visible.

They also urge regulators to crack down on “SIM farms” - servers housing thousands of SIM cards used for such services.

They proposed making the purchase and registration of SIM cards more complex, as long as the user’s privacy is not unduly sacrificed.

Price tracking data from Cotsi can be used to track whether such policy changes are having their intended effect.

However, the researchers warned that the publication of their study could also prompt SMS verification providers to limit access to their data, which could complicate future studies.

Stricter registration in Malaysia

Malaysia requires proof of identity, like a MyKad, for SIM registration. Since June 2017, individuals have been limited to five prepaid cards.

The government is making the process more stringent in a bid to fight cybercrime.

Since Dec 1, telecommunications companies have begun integrating the MyDigital ID app to verify identities against official records.

Deputy Communications Minister Teo Nie Ching told the Dewan Rakyat in October that new regulations are expected by the first quarter of next year that would limit Malaysian citizens to two prepaid cards per telco, and two SIM cards in total for foreigners.

With 12 licensed telcos, this would still allow up to 24 prepaid cards per Malaysian citizen. - Mkini