Fake Purchase and Bank Alerts Drive Tech Support Scam Calls
Summary
Hornet Security identified over 150,000 messages and more than 40 callback numbers from September 18 to October 2, 2026. Its calls found operators following transaction scripts; the numbers were associated with Onoff, but the users were not identified.
Key points
- From September 18 to October 2, 2026, Hornet Security identified more than 150,000 messages and over 40 callback numbers.
- Messages impersonated retailers with fake purchase confirmations and banks with alerts about logins, transfers, or payments, urging recipients to call.
- The callback numbers were associated with the Onoff service; this did not identify the users or attribute the campaign to Onoff.
- In calls to the numbers, operators asked for the caller’s name and transaction reference, then repeated details from the message. They sent a file by MMS, but researchers could not retrieve or analyze it.
- Onoff promptly handled several takedown requests, but the researchers were unable to reach its anti-fraud team.
- Security teams can correlate normalized phone numbers with message wording and impersonated brands. Recipients should verify transactions through banking apps or contact details obtained independently.
Article Details
- Attack Vectors
- Messages impersonated retailers with fake purchase confirmations or invoices and urged recipients to call a supplied number to dispute the purchase.
- Messages impersonated banks with alerts about new-device logins and pending transfers or payments, urging recipients to call a supplied number.
- During calls, operators asked for the caller's name and transaction reference, then repeated details from the message to make the conversation credible.
- Operators sent a file by MMS during examined calls; its contents and role could not be determined.
- Defensive Notes
- Look for unusual transactions, high amounts, callback instructions, expensive-electronics purchases, new-device login alerts, and claims that a transfer is pending.
- Normalize phone numbers and correlate them with message wording, displayed identities, and impersonated brands to identify variants.
- Verify transactions through a banking app or independently obtained official retailer or bank contact details; do not call the number in the message.