Beware of possible new scam | Binance

[Ultegra134]

Hi,
Just a while ago I received a suspicious SMS message from a number supposedly from Binance. I was intrigued at first because it appeared to be Binance itself, since you can also see previous messages from the 2FA authentication when logging in. It said that a new Ledger wallet was connected to my Binance account and if this action wasn't done by me, to contact them at a Greek number.

A quick Google search showed other reports of it being a scam, however, I'm now curious, how do they spoof the sender's number to actually show up as Binance, is this a global scam or has it only appeared in Greece? Most importantly, how did they get my number? Did they know I have a Binance account or was it completely random? Perhaps this has something to do with a suspected data breach that I had also posted about a few months ago?

[Cantsay]

I think this is a case of data breach.

I just did a search and I came across a post on Reddit with this exact message - so I don’t think it was random, they probably got the information of some Binance users and then spam them this message.



https://www.reddit.com/r/ledgerwallet/comments/1gmlq7p/ledger_scam/?rdt=51360 Just go through the thread and you’ll come across some important info about this scam.

[cabron]

Looks like from Binance especially when you see the previous messages from Binance.
You'd likely believe it's from them however if you are not the one who connected a ledger wallet then definitely an impostor. Thats a very sophisticated hack.

If it's indeed a breach, it will help if you change your binance email and login details before something happens to the funds in your account. Maybe reporting it to binance will help them also secure your account.

[Ever-young]

Most importantly, how did they get my number? Did they know I have a Binance account or was it completely random? Perhaps this has something to do with a suspected data breach that I had also posted about a few months ago?

It's very easy for them to send you a message, and it will appear that it was sent by Binance or whichever name they want to appear as the sender.
 
First, what they need is to know the exact way Binance's name appears on the receiver's phone whenever they send out a message. They will use one of these providers that deal in bulk SMS, which you can be allowed to customize your message and send across to various contacts at once. 
 
In my country we use

Code:

 https://www.bulksmsnigeria.com/ 

I can recall one time when I used it to customize an employment message and sent it to my kid sis, who ran away from the house because of a minor disagreement. I customized the sender to be from one popular shopping complex, "Everyday Supermarket.".
 
The first thing to make such a success is to first get the target number, which I believe the scammers do have, and then be sure that the number is also what they use in receiving messages from the organization they tend to impersonate, and everything is simple from there. 
 
Some things are developed to make life easier for scammers, who are always looking for a way to exploit it to their own advantage; we just have to be vigilant.

[holydarkness]

Looks like from Binance especially when you see the previous messages from Binance.
You'd likely believe it's from them however if you are not the one who connected a ledger wallet then definitely an impostor. Thats a very sophisticated hack.

If it's indeed a breach, it will help if you change your binance email and login details before something happens to the funds in your account. Maybe reporting it to binance will help them also secure your account.

I think you understand the narrative a bit wrongly. the "breach" itself is not happened yet, or at all. OP's account are not hacked, no one tried to gain access to his account and got thwarted by 2FA.

Rather, the scammer sent him a message, that's shown as from binance, saying that there is an attempt into his account which would prompt him to secure it by calling the number. The hack itself will very much likely to happen when and if the OP reached to that number.

[Davidvictorson]

This scams are getting very highly and extremely sophisticated. It is very easy for someone who is not meticulous to fall victim. I strongly believe that these scammers buys the contacts of people who use exchanges from a third party and they know how to socially engineer it to look the support staff of the exchange. As far as I know no exchange will send a message to their customer first. It is always the other way around. Don't be surprised that even the Greek number doesn't mean it is originating in Greece. They could have masked the number to that location.

[Ultegra134]

I think this is a case of data breach.

I just did a search and I came across a post on Reddit with this exact message - so I don’t think it was random, they probably got the information of some Binance users and then spam them this message.

https://www.reddit.com/r/ledgerwallet/comments/1gmlq7p/ledger_scam/?rdt=51360 Just go through the thread and you’ll come across some important info about this scam.

Good catch, thanks. I didn't think of googling it do to it being a Greek number; thought it was a "local" scam.

~Snipped~

It's annoyingly frustrating how easy it is to spoof a number or the sender's ID.

I think you understand the narrative a bit wrongly. the "breach" itself is not happened yet, or at all. OP's account are not hacked, no one tried to gain access to his account and got thwarted by 2FA.

Rather, the scammer sent him a message, that's shown as from binance, saying that there is an attempt into his account which would prompt him to secure it by calling the number. The hack itself will very much likely to happen when and if the OP reached to that number.

To be honest, I'm quite intrigued to call the number, perhaps from a different phone or using an unknown number. I'm curious, is it actually based in Greece, what are they going to ask for? Should I troll them? I don't think there's any risk if I simply give them a call, could they possibly charge me?

[Cantsay]

To be honest, I'm quite intrigued to call the number, perhaps from a different phone or using an unknown number. I'm curious, is it actually based in Greece, what are they going to ask for? Should I troll them? I don't think there's any risk if I simply give them a call, could they possibly charge me?

If you do go through with this plan don’t forget to update us on their response - and make sure you use a phone number that you haven’t used for any crypto related stuff that way you won’t be risking too much.

But if you don’t have phone number like that you can just choose to ignore.

Edit:

I also searched the number and this came out as one of the results.



And if you keep looking you’ll see that the other results are also related to this company, so I’m guessing that number might not even give you any results if you call them.

[holydarkness]

[...]
To be honest, I'm quite intrigued to call the number, perhaps from a different phone or using an unknown number. I'm curious, is it actually based in Greece, what are they going to ask for? Should I troll them? I don't think there's any risk if I simply give them a call, could they possibly charge me?

Could they possibly charge you? Well, I don't think so. Your phone provider will, though. As you make a phone call. At glance, it's not a premium number, so the call rate will be quite flat.

There is this youtuber who gather viewers with this, prank-calling a scammer and get them to their boiling point. IIRC, at one session, he even worked with one crypto wallet provider to catch the bad guy.

All things considered, if I were you, I think it's too much headache for me. Yes, it'll bring me closer to the bottom of the case, but I imagine their replies when you call them [if they ever picked that up] will be evasive, rude and ambiguous before they finally hang up.

[tabas]

I think that they are purchasing tools to SMS spoof and they're not that expensive at all. This might be the new trend for scammers and looks effective on their end that the victims will easily believe that they're from Binance or any other genuine service that the victim has been using.

Should I troll them? I don't think there's any risk if I simply give them a call

If you want to have fun and you have a lot of spare time, you can do it. But don't waste your time with these and ignore them, because even if you report them to binance there are for sure reports of it already and it should be them to take down those tools and track wherever they've got that SMS spoof that copies their name. IMHO, they should contact all of those services and should be outright used only for them or not allow any other customers to use that name for spoofing. I feel bad that there are for sure likely victims who have been baited by that scam.

[PX-Z]

I'm now curious, how do they spoof the sender's number to actually show up as Binance,

It is technically possible so no need to curious about it, what you need to curious about is how they get your number and why they knew that you used Binance.

Is this a global scam or has it only appeared in Greece?

Probably it's global, the attackers just like seems from Greece.

Perhaps this has something to do with a suspected data breach that I had also posted about a few months ago?

Data breach in Binance? Might probably on their previous breach from few years ago, im not so sure. Did you use this mobile number from different platforms too?

[Ultegra134]

Data breach in Binance? Might probably on their previous breach from few years ago, im not so sure. Did you use this mobile number from different platforms too?

I'm talking about this.

Perhaps it's irrelevant, but it's a little frustrating. Yes, this is the main number I use when signing up on any platform that requests it, so it's possible the data breach is stemming from somewhere else, except Binance.

I tried calling the number, it automatically answers and hangs up. I was in the mood of messing around with them but seems unlikely.

[PX-Z]

I'm talking about this.

Perhaps it's irrelevant, but it's a little frustrating. Yes, this is the main number I use when signing up on any platform that requests it, so it's possible the data breach is stemming from somewhere else, except Binance.

Oh, yeah. It looks like it came from that incident, i checked google and it seems like its legit. Well, now talking about mobile number, if this number is just for crypto transactions and registrations, and not for personal use, then it's good.
You should have other mobile #s for personal use just like mine when my mobile number used was linked to my ledger ecommerce profile then it was hacked few years back, i received lots of spam calls from that too, i answered once accidentally they know my name and asked me something about crypto, that time i knew where it came. So i get different # for personal then use the old one for crypto txs and

[Ultegra134]

I just received another SMS which was quickly considered spam from the Google messages app, along with a link to this scam website

ledgeractivate.com

or this phone number.

2111987675

I called, an English speaking person picked up, of course, the call wasn't from Greece, sounded like he was trying too hard to sound native English though.

Edit: Now that I'm looking at the website, the landing page is an exact copy of the actual Ledger website.

[shasan]

lt is obviously data breach and it had happen from the date you shared virtually or it is from any person who knows hacking and know your number. I think if you contacted with the person then the person may convince you to follow the person and as a result you might have lost your balance. But I could not understand if you didn't contact with the number then how they could scam you.

[pinggoki]

Binance doesn't contact you like that I think, I've seen how they contact you and the SMS doesn't have a name on it so I don't think that Binance is really contacting you personally, this is already a red flag, when you can see who's texting you, most of the time, companies don't do that because they want it to be a one way communication. It's not a new scam, the only new thing here is the entity that they're impersonating.

[albon]

I just received another SMS which was quickly considered spam from the Google messages app, along with a link to this scam website

ledgeractivate.com

or this phone number.

2111987675

I called, an English speaking person picked up, of course, the call wasn't from Greece, sounded like he was trying too hard to sound native English though.

Edit: Now that I'm looking at the website, the landing page is an exact copy of the actual Ledger website.

I think you need to change your number to a new one, as this second message containing a scam indicates that your number has been targeted by scammers. It is good that the message was marked as spam, as the site is indeed a phishing site that was created 11 months ago. I think they will not stop sending you such phishing messages, so you need to secure all your accounts linked to this number with additional security methods.

I will now file a report to the fraudulent domain registrar so that it can be completely restricted, as it poses a threat to users who received the same message and might think they are dealing with a legitimate site. As for these numbers, try to ignore even contacting them and putting them on the blacklist; you don't know how their tricks might be used to persuade you.

[Ultegra134]

I think you need to change your number to a new one, as this second message containing a scam indicates that your number has been targeted by scammers. It is good that the message was marked as spam, as the site is indeed a phishing site that was created 11 months ago. I think they will not stop sending you such phishing messages, so you need to secure all your accounts linked to this number with additional security methods.

I will now file a report to the fraudulent domain registrar so that it can be completely restricted, as it poses a threat to users who received the same message and might think they are dealing with a legitimate site. As for these numbers, try to ignore even contacting them and putting them on the blacklist; you don't know how their tricks might be used to persuade you.

That would be ideal but it's not as easy as it sounds. I'll have to go through the hassle of informing all usual contacts that I've changed numbers and most importantly, update my number with proof of ownership on any government related services and bank accounts. It's a real hassle I wouldn't go through the trouble.

Binance has issued an official announcement regarding the phishing SMS messages shortly after I received the second SMS. It seems that things have calmed down for the time being.

[Ultegra134]

It’s frustrating how these incidents can undermine trust in platforms. Staying cautious and reporting suspicious messages and websites is a proactive way to protect the broader community.

You’re handling this well, stay safe, and thanks for raising awareness!

It's astonishing that you had to use AI just to write a two liner post. Did you really need to use it, couldn't you come up with something to say yourself?

[Rikafip]

Binance has issued an official announcement regarding the phishing SMS messages shortly after I received the second SMS. It seems that things have calmed down for the time being.

Seems like scammers are still trying as earlier today I got the message that says "You logged in from a new device in Bucharest (Romania) and if it wasn't you, call us immediatelyl at xyz etc".  

I can imagine bunch of people actually falling for it as it looks like Binance actually sent you a message.