A Chinese woman has been arrested in Oman after she was found driving a rented car that carried a fake base station. The vehicle had reportedly circled the Muscat Governorate, the province that includes Muscat City, Oman’s most populous city. The radio equipment allegedly was used to send SMS messages containing links to phishing websites.
The police announced the arrest by posting a polished video to social media. The video includes footage of the SMS blaster and of the Chinese national as she entered the country. Police officers spoke in the video about the danger of clicking on hyperlinks in SMS messages that lead to websites which impersonate banks. Very little information about the woman’s alleged crimes was shared, but an illustrative image shared by the police displayed an SMS message including a URL that contains the words ‘bankmuscat’. Bank Muscat is Oman’s largest bank.
We have already updated the SMS blaster map in our Global Fraud Dashboard to reflect this news. The data in the map shows that the international spread of fake base stations for smishing frauds has accelerated. However, it is painfully obvious that the sources of intelligence used to inform national law enforcement policies are woefully unsuited to the task of collating and drawing conclusions from all of the available data.
I have repeatedly seen national authorities and professional associations reciting piecemeal stories about the use of SMS blasters in other countries while seemingly oblivious to more recent examples. This leads to skewed perceptions about the scale and spread of SMS blasters. News in the English language, and countries that place more emphasis on warning the public generate disproportionate attention compared to SMS blaster cases that are reported in other languages or where the local authorities have chosen to minimize news coverage. The inconsistent use of terminology — fake base stations, SMS blasters, IMSI‑catchers — leads ill-informed journalists to confuse surveillance with fraud and to confuse simboxes with fake base stations. None of those terms were used by the Royal Oman Police, but their description of the radio equipment and its use was clearly consistent with the way SMS blasters have been used for smishing frauds in other countries.
Simply googling ‘fake base station’ or ‘SMS blaster’ may be sufficient for some people who want to stand in front of audiences and claim to be experts in international fraud, but presenting an incomplete picture has encouraged complacency. Contrary to what many say, the use of SMS blasters for smishing is not ‘new’. It is no more new than the use of a 10 year old vulnerability to gain access to a system that has never been hacked before. Just because you have never previously been the victim of a crime does not mean the criminal is doing something new.
A patchy understanding of this criminal method also means crime prevention policies are not as well targeted as they should be. That is why Commsrisk made the decision to step up, and to start using AI to scour the news in every language for intelligence about SMS blasters. We are doing it to influence the regulators and government officials who read this website. Few Western journalists would dare to associate SMS blaster scams with China. They are afraid of being called racists. Their fear is understandable, given how few cases they are aware of. But when you review more cases, the similarities are so common that they should not be ignored by policymakers and law enforcement.
Western countries are too politically paralyzed to impose import controls on fake base stations even though East Asian countries like Thailand and the Philippines openly use border controls to stop SMS blasters getting into the country. Oman’s police shared a video recording of the Chinese woman handing over her passport at the airport, but the real question is how the equipment she used was transported to Oman. We will not stop people crossing borders but societies could do a lot more to obstruct the transportation of radio equipment that is hardly ever used for a legal purpose. Too much effort is being directed towards the end user — by getting them to disable 2G for their handset, or warning them about clicking links — relative to the effort that goes into hunting down the kingpins who run organized crime. Mobsters will easily replace the woman who drove this particular SMS blaster around Oman. We need to take away the mob’s money before it is reinvested into the equipment used for the next scam, and the scam after that.
Images of the SMS blaster equipment and of the Chinese national entering Oman are reproduced below. The video announcement posted to the official Facebook page of the Royal Oman Police can be viewed at the bottom of this article.
