Attackers are using “wrong-number” texts to identify potential targets for scams, according to researchers at Malwarebytes.
These texts appear to be harmless messages meant for another person, such as “Are we still on for dinner tomorrow?” or “Where’s the PowerPoint?” Recipients often try to be helpful by replying to let the person know they’ve got the wrong number. This reply, however, informs the threat actor that the phone number is active and marks it for future scams.
“Let’s be clear: the ‘wrong number’ text is not a phishing link,” the researchers explain. “It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test. The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email.”
If you reply to one of these texts, the attackers also learn the following things about you:
- You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.
- You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.
- You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your time zone, and indicate how likely you are to respond to future messages.
AI-native security awareness training can help your employees understand how attackers think so they can avoid falling for social engineering tactics. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
Malwarebytes has the story: https://www.malwarebytes.com/blog/threat-intel/2026/08/your-polite-reply-to-that-text-is-worth-2-on-the-dark-web
