Managing risks in an evolving cybersecurity environment
In today’s digital landscape, the rise of mobile device usage has made enterprises increasingly vulnerable to fraud. Recent research indicates that 76% of enterprises lack sufficient protection against voice and messaging fraud. This gap in security has become a critical vulnerability as smishing (SMS phishing) and vishing (voice phishing) surge following the recent developments in AI technology, which allows fraudsters to target more victims with increased sophistication. With 61% of enterprises reporting significant financial losses due to mobile fraud, it is evident that combatting these threats requires a proactive and innovative approach. There is only one caveat: enterprises need Mobile Network Operators (MNOs) for real-time protection against smishing and vishing.
The Growing Sophistication of Phishing Attacks
Phishing attacks have evolved in their complexity and sophistication. Education and cybersecurity tools have raised the bar for scams to succeed. One example is how cybercriminals leverage trusted cloud platforms such as Amazon S3, Google Cloud Storage, and IBM Cloud Object Storage to host malicious content. These campaigns leverage the credibility of well-known cloud domains to bypass network firewalls and target users with smishing scams. By clicking on seemingly legitimate links, victims are redirected to fraudulent websites designed to steal sensitive information such as passwords, banking details, and personal data.
Vishing presents a parallel challenge. By exploiting vulnerabilities in communication networks, spoofing attackers present a familiar calling number to impersonate trusted entities. For a few years now, deepfakes have enhanced voice fraud. The sound of a familiar voice can easily lull victims into a false sense of security, convincing them that the call is legitimate — even when the requests being made should set off alarm bells. For instance, the growing number of cases where voice clones have been used to carry out convincing CEO fraud.
This level of sophistication highlights the critical need for enterprises to strengthen the security of their telecom services. Traditional approaches, like training staff to spot fraud attempts, are no longer enough to keep pace with the ingenuity of cybercriminals who manipulate trust to execute their attacks.
Why Mobile Fraud Must be the Responsibility of Mobile Network Operators
However, preventing spoofing, vishing, and smishing goes beyond the reach of any enterprise’s CISO. While they should implement security awareness training and enforce robust policies, they lack direct control over the mobile network infrastructure through which smishing and vishing attacks are delivered. Instead, the responsibility lies with MNOs, who have the capability to deploy advanced network-level anti-fraud solutions, such as messaging and voice firewalls. These tools enable MNOs to block malicious messages and calls in real-time before they reach the subscriber, eliminating any chance of success for the fraudster. Therefore, the responsibility for preventing smishing and vishing attacks primarily falls on MNOs, who have the technical capabilities to safeguard mobile communications at the network level. However, enterprise CISOs still play a critical role as decision-makers; by choosing telecom services with strong built-in security measures, they can ensure their organisation is better protected against these evolving threats.
In today’s world, where threats are increasingly multi-dimensional — spanning both physical and cyber domains — strategic surveillance is more critical than ever.”
Leveraging AI to Combat Smishing and Vishing
To address the growing threat of vishing and smishing, MNOs must deploy advanced tools that can detect and block malicious content in real-time, including zero-day scams.
AI helps fraudsters rapidly field new variants of scams using dynamically created content. Static countermeasures, such as checking numbers against block lists or filtering out messages with known bad URLs, get outdated before being deployed.
Instead, adaptive security for voice and messaging channels is instrumental in mitigating vishing and smishing campaigns, offering zero-day protection against new scams. AI plays a pivotal role here, as it can analyze content in real time and identify potential threats before they reach end-users, significantly reducing the risk of successful attacks. For instance, AI-driven URL analysis can detect whether a previously unseen URL in a message is malicious, blocking it with remarkable accuracy. AI can also be used to find prohibited images in rich media messages or scam texts sent as images — a tactic increasingly used by fraudsters to bypass traditional text message filters. Another emerging application of AI is the detection of voice clones during calls. While not yet widely deployed across mobile networks, this capability will become critical in keeping subscribers secure as scammers increasingly leverage voice cloning technology.
While AI can detect and block many cases of smishing and vishing, it is not the solution to everything. Some use cases for mobile network security are better protected using other methods, including rule-based security and threat intelligence. In either case, the velocity with which new scams are fielded requires any firewall or security tool to be adaptive to ensure that the mobile network remains protected against the latest security risks.
The Importance of a Multi-Layered Defence Approach
The evolving nature of mobile fraud demands a multi-layered defense strategy. While no single solution can eliminate the risk of phishing and spoofing entirely, combining various tools and technologies can significantly reduce vulnerabilities. Key components of an effective strategy include:
- Real-time threat detection: Deploying systems capable of identifying and blocking malicious content in real-time.
- Voice and messaging firewalls: Implementing robust defenses against spoofing and smishing attacks.
- Threat intelligence: Identifying and tracking complex threats as they appear on mobile networks, providing proactive protection.
- Adaptive security: Constantly keeping defenses up to date to defend against new and morphing threats.
- Continuous education and training: Equipping employees and users with the knowledge to identify and avoid phishing attempts.
A Collaborative Effort
Securing global communication networks requires collaboration between enterprises, network operators, and technology providers. Cybersecurity solutions must evolve in tandem with the threat landscape, ensuring that organizations remain resilient against increasingly sophisticated attacks. By investing in advanced tools such as messaging and voice protection solutions, enterprises can safeguard their communications and protect sensitive data from malicious actors.
While phishing and spoofing may never be entirely eradicated, the adoption of adaptive security measures is vital to mitigating risks. Through innovation and collaboration, organizations can build a robust defense against the dynamic challenges of the mobile device threat landscape, preserving the integrity of their operations and the trust of their users.
