SMS Blasters: The New Drive-By Text Scam Targeting Everyone Nearby

Click here to view/listen to our blogcast.  

Scammers are leveling up again. A new tool called an SMS blaster lets criminals impersonate a cell tower, force nearby phones to connect, and push mass scam texts to every device in range. Because these messages do not travel through normal carrier systems, the usual anti-spam filters never see them. Recent arrests and industry warnings show this is moving from proof-of-concept to a real-world problem.

What Is an SMS Blaster and Why It Matters

An SMS blaster is a portable base-station look-alike. It lures phones to attach on 4G, then downgrades them to weaker 2G so it can inject texts directly. Attackers can spoof trusted senders like banks or tax authorities and blast tens of thousands of messages per hour to everyone within a radius that can reach roughly a city block or more, depending on power and environment. Since the traffic never crosses carrier gateways, it dodges reputation systems and filtering.

What makes it different from typical smishing:

• Does not need your phone number in advance
• Bypasses carrier spam controls
• Can saturate dense areas in minutes
• Harder to trace because the “sender” is a moving device, not a rented SMS platform

What We’re Seeing Right Now

• Law-enforcement cases. UK police jailed a student who ran an SMS blaster from his car, sending fake HMRC texts across London. Similar busts have occurred in Thailand.
• Industry alarms. The GSMA’s Asia Pacific taskforce urged governments and carriers to act, citing the rise of local “blast” devices and growing consumer losses to digital scams.
• Broader smishing ecosystem. Organized groups already run huge URL-driven campaigns; SMS blasters amplify reach by removing the need for phone-number lists in a given neighborhood.

What This Looks Like to a Victim

You receive a text that appears to be from your bank, tax agency, delivery service, or toll authority with a link to “verify” or “pay.” Because the message never touched carrier filters and may carry a convincing sender name, it looks authentic. One click can lead to credential theft, account takeovers, or instant card-fraud via mobile wallets.

Actionable Steps for Everyone

On your phone

• Disable 2G if your device allows it. Many Android models support this in Network settings. iPhone users can use filtering features and consider Lockdown Mode for high-risk profiles.
• Never tap links from unexpected texts. Open the official app or type the known website instead.
• Report suspicious texts by forwarding to 7726 (SPAM) where supported. This helps carriers investigate patterns.
• Use strong MFA with an authenticator app, not SMS codes, to reduce the blast radius if credentials leak.

For SMB owners and IT leads

• Block known smishing domains at the DNS layer and enable safe browsing controls on all endpoints.
• Mobile device management: enforce OS updates, restrict sideloading, push phishing-resistant MFA, and, where possible, disable 2G.
• Security awareness with live drills: run quarterly smishing simulations that include text-based lures.
• Payment-change procedures: never approve banking or payroll changes from a link in a text. Require an out-of-band callback using a verified number.

How CDML Can Help

• DNS and web filtering stack that blocks malicious domains fast, paired with email and SMS-aware security training.
• Mobile device hardening via MDM policies, including 2G disablement where supported and phishing-resistant MFA.
• Incident Response and DR playbooks tuned for smishing incidents: rapid domain blocklists, credential resets, and fraud containment.
• Executive briefings and staff training focused on text-driven social engineering, reinforced with periodic drills.
• Continuous monitoring and reporting so you can demonstrate due diligence for frameworks like NYDFS, HIPAA, NIST, and GLBA.

Final Thoughts

SMS blasters change the game because they turn physical proximity into mass reach. Until carriers and regulators can consistently detect and shut down rogue base stations, the best defense is layered: harden devices, train people, and enforce processes that never rely on links in unsolicited texts. Contact CDML today to put those layers in place and keep your team safe.

Stay safe. Stay informed.

📞 Contact us here: https://cdml.com/contact/
📚 Read more on our blog: https://cdml.com/blog-2
📺 Listen to our blogcasts: https://www.youtube.com/@CDMLComputerServices