BillBait Uses SMS Autofill to Obscure Recurring Subscription Charges
Summary
Gen Threat Labs describes “BillBait,” misleading mobile subscriptions that use SMS-code autofill to make recurring-payment authorization resemble routine phone verification, and recommends reading the full SMS before submitting a code.
Key points
- Gen Threat Labs examined SMS-autofill subscription journeys in Poland, Switzerland, Denmark and Canada.
- The article calls journeys “BillBait” when they use SMS autofill to let people authorize a subscription without opening the message explaining its terms.
- The examined messages pair a code with a website domain, allowing a phone or browser to offer autofill; the code can authorize recurring mobile-account charges.
- On the tested iPhone, the suggestion showed 14.99 zł but not that the charge repeated weekly. Chrome’s Android prompt displayed the full SMS, including the weekly charge.
- Captured ads emphasized phone verification or generic “Continue” and “Next” buttons; affected users also reported deceptive QR codes related to parking and EV charging.
- The researchers advise opening the full SMS, checking the service and billing frequency, and contacting the mobile operator about unfamiliar charges. Blocking the sender or marking the message as spam does not stop charges.
Article Details
- Topic
- Misleading mobile subscription journeys that use SMS autofill to authorize recurring charges
Vendors
AppleOn the iPhone we tested, Apple’s autofill suggestion showed 14.99 zł without saying that the charge would repeat every week. Chrome displayed the full SMS, weekly charge included, but inside a browser prompt thatGoogleGoogle’s guidance on SMS codes describes banks and card issuers using them as an additional security check during a payment. In the subscription journeys we examined, the code itself is the only authorization and
Products
Google ChromeThe subscription authorization SMS, displayed in Chrome's permission prompt, includes the bi-weekly charge and the domain and code used for autofill.iPhoneincluding how often it repeats, but someone can accept the suggested code without opening it. In the iPhone example we tested, the suggestion displayed an amount while leaving out the fact that it would be charged
Countries
CanadaAt Gen Threat Labs, we have been examining subscription journeys in Poland, Switzerland, Denmark and Canada. Our investigation looks at the use of these autofill-formatted messages in services charged through a mobileDenmarkAt Gen Threat Labs, we have been examining subscription journeys in Poland, Switzerland, Denmark and Canada. Our investigation looks at the use of these autofill-formatted messages in services charged through a mobilePolandAt Gen Threat Labs, we have been examining subscription journeys in Poland, Switzerland, Denmark and Canada. Our investigation looks at the use of these autofill-formatted messages in services charged through a mobileSwitzerlandAt Gen Threat Labs, we have been examining subscription journeys in Poland, Switzerland, Denmark and Canada. Our investigation looks at the use of these autofill-formatted messages in services charged through a mobile