‘Hey mum, I dropped my phone down the toilet’: Investigating Hi Mum and Dad SMS Scams in the UK
An empirical study of the 'hi mum and dad' SMS scam, a new interaction-based fraud technique. The research dissects the scam's lifecycle, from initial contact to financial exploitation, by analyzing scam messages, mobile network data, and mule accounts in collaboration with a UK mobile operator. Key findings reveal the psychological principles used, the abuse of mobile and financial infrastructure, and the underlying structure of scammer networks.
The nature of SMS fraud is evolving from simple, one-off phishing links to more sophisticated, interaction-based scams. One prominent example is the “hi mum and dad” scam, where attackers impersonate a child in distress to solicit financial help from their parents. This research presents the first empirical study of this specific scam, conducted in collaboration with a UK-based mobile network operator and the non-profit Stopscams UK.
Methodology
The study is based on a dataset comprising 3,402 initial scam texts and 711 engaged conversations collected over three months in the summer of 2023. The researchers proactively interacted with scammers to gather data. The methodology involved a multi-pronged approach:
- Textual Analysis: Analyzing the content of both initial messages and subsequent conversations.
- Mobile Network Analysis: Using Home Location Register (HLR) lookups to validate phone numbers and identify their network operator and status.
- Financial Analysis: Investigating the 582 unique “mule accounts” provided by scammers, analyzing the financial institutions they belong to, and the amounts requested.
- Network Analysis: Mapping connections between scammer phone numbers and the mule accounts they use to identify organized criminal networks.
Scammer Tactics and Communication
Textual analysis of the initial scam messages reveals a clear preference for moving the conversation to encrypted platforms like WhatsApp. The messages frequently use “mom” more than “dad,” suggesting scammers primarily target female users.
The engaged conversations follow a predictable three-response pattern, analyzed using n-grams:
- First Response: The scammer establishes an emotional connection, using words like “stressed” or “idiot” to explain their situation (e.g., losing their phone).
- Second Response: They maintain the emotional tone while introducing a financial problem, such as being locked out of their bank account.
- Third Response: The emotional language disappears, and the focus shifts entirely to the financial request, such as needing to pay a bill.
This communication strategy leverages several psychological principles to deceive victims, primarily Kindness (a parent’s willingness to help), Distraction (confusing details about the lost phone), and Time (creating urgency to prompt an irrational decision).
Abuse of Technical Infrastructure
Mobile Networks
The study found that one mobile network operator (MNO) was disproportionately abused. This is likely because it still supports legacy GSM (2G) networks, which are commonly exploited by SIM farms and SIM boxes used to send the initial wave of scam messages.
Survival analysis revealed a significant difference in the lifespan of the phone numbers used:
- Originating Sender IDs: These numbers, used for the initial mass-messaging, have a very short active life before being taken down.
- Scammer Interaction Numbers: These numbers, used for the one-on-one conversation, remain active for a much longer period, with a median lifespan of 46 days. This indicates that MNOs are less effective at detecting and disabling numbers used for interaction compared to those used for spamming.
Financial Networks
Over the three-month study, scammers requested over £577,000 through 582 unique mule accounts. The analysis of these accounts revealed key patterns:
- Platform Differences: Scammers tend to request smaller amounts of money over SMS and significantly larger sums over WhatsApp, possibly reflecting different attacker strategies or perceived victim trust on different platforms.
- Institutional Targeting: Most mule accounts were held at High Street banks (traditional brick-and-mortar banks) and Electronic Money Institutions (EMIs, e.g., Revolut). Scammers requested smaller, more frequent amounts from EMI accounts, likely to fly under automated fraud detection thresholds. Conversely, they requested much larger lump sums from High Street bank accounts.
- Geolocation: By mapping the physical branches associated with High Street bank sort codes, the study found that the location of mule accounts correlates with population density and unemployment rates. However, it also identified key outliers in low-density areas, providing valuable intelligence for law enforcement to target investigations beyond obvious urban centers.
Scammer Networks and Impact
By creating a graph network, the research connected scammer phone numbers to the mule accounts they provided. This revealed distinct, organized groups of threat actors. One identified group consisted of 8 phone numbers that provided 31 different mule accounts across 8 financial institutions, collectively requesting over £40,000.
The financial impact of this scam is substantial, estimated at £23 million ($29 million) per year in the UK alone. The research findings were submitted to regulators like Ofcom, contributing to policy changes such as the UK’s ban on SIM farms and new Spanish legislation to combat SMS scams.