Can the apparent sender of an SMS be spoofed?¶

An SMS may appear to come from a trusted number, organisation or contact.

Evidential caution: that the displayed sender information proves the true origin.

What this means¶

SMS sender information can sometimes be manipulated or substituted, particularly where messages are sent through internet gateways, bulk-messaging platforms or alphanumeric sender services.

A spoofed message may display a familiar number or brand name even though it did not originate from that subscriber or device.

Inspect links, payment requests, callback numbers and surrounding account activity. The infrastructure behind the message may provide stronger attribution than the visible sender field.

Where the issue is important, seek specialist support and current provider information.

In reports, distinguish “the SMS displayed this sender” from “the message originated from this number or organisation.”

What to check or do next¶

• Preserve the message, sender field, time, content, links and any reply behaviour. Record whether the message joined an existing conversation thread, because some devices group messages by displayed sender.
• Check provider or gateway records where available. These may help identify the route through which the message entered the network.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

That does not mean every unusual SMS is spoofed. It means the displayed sender should be tested rather than accepted automatically.

Do not assume that a spoofed sender can receive replies. In many cases, the displayed identity is only presentation information.