PSA: Watch out for 2FA phishing texts pretending to be from Rogers

Rogers customers (and likely most Canadians with a cell phone) will want to watch out for phishing texts pushing them to set up two-factor authentication (2FA) with their carrier.

A Reddit user posted to the r/Rogers subreddit about a text they received that claimed to be from Rogers. The text threatened that the user’s service would be suspended if they didn’t sign up 2FA. The message also included a fake link to set up 2FA.

The Redditor noted that their phone flagged the messages as spam but that they wanted to make sure anyway.

Rogers 2FA phishing text. | Image credit: TJ-X (Reddit).

While the text might be obviously fake to some, it’s worth highlighting since not everyone will know what to look for, and messages like this could fool some people. So with that in mind, here are some warning signs to look out for in messages like this:

• Legitimate messages from companies typically use shortcodes (five- or six-digit numbers) and not regular 10-digit phone numbers.
• The URL is suspicious.
  • In the case of this Rogers phishing message, the expected URL would be something like ‘rogers.com/2fa’ or ‘2fa.rogers.com.’
  • Common signs of a fake URL include the use of hyphens in place of periods (e.g. account-example.com instead of account.example.com), misspellings and swapped letters (e.g. ‘roger.com’ instead of ‘rogers.com,’ or ‘examp1e.com’ instead of ‘example.com’).
• Threatening messages (such as this text’s warning about suspending service) are also a red flag.
• Most smartphones will flag messages like this as scams or spam, so watch for and heed those warnings.

If you’re ever in doubt about the legitimacy of a message, avoid clicking any links or sharing any information. Using this Rogers phishing message as an example, it’d be better to reach out to Rogers directly rather than clicking the suspicious link.

When you receive suspicious messages like this, it’s also a good idea to report it. Most phones allow you to report spam messages right in the messaging app. You can also report suspicious sites, such as with Google’s SafeBrowsing report page.

Source: Reddit