Written July 29, 2025 – 14:00 EDT

The FBI has issued a renewed warning to iPhone and Android users across the United States, advising them to avoid responding to suspicious text messages—even those that seem to come from friends or familiar companies. According to a recent public service advisory, cybercriminals are exploiting text-based two-factor authentication (2FA) to hijack personal accounts, steal identities, and defraud individuals.

With billions of scam texts circulating annually in the U.S., federal authorities say Americans must remain vigilant and adopt stronger digital security habits to avoid falling victim to these increasingly sophisticated attacks.

Rise of scam texts targeting personal accounts

The FBI’s alert focuses on the growing use of fraudulent text messages and voice calls—also known as smishing (SMS phishing) and vishing (voice phishing)—to trick users into giving away sensitive information such as login credentials, financial data, or temporary security codes.

Common scam text examples include fake messages about:

• Undelivered packages
• DMV penalties or unpaid tolls
• Suspicious bank activity or Amazon refunds

These messages often impersonate trusted institutions and urge users to click a link or reply urgently. Once a victim engages, attackers use social engineering techniques to gain access to personal information or send malicious links that install spyware.

In its most recent advisory, the FBI emphasized that users should never respond to text messages or emails unless they can verify the sender’s identity. Even if a message appears to come from a friend, coworker, or family member, it may be the result of a compromised account.

Why sharing 2FA codes is dangerous—even with people you know

Two-factor authentication (2FA) is widely used as an added layer of protection for online accounts. It typically requires a user to enter a one-time passcode (OTP) sent via SMS or email after entering their password. While 2FA is strongly encouraged, text-based OTPs are also one of the weakest links in digital security when misused.

According to the FBI, threat actors can manipulate users into forwarding 2FA codes, even when those users have followed standard security practices. For example, if a criminal gains access to a person’s messaging account, they might impersonate that person and ask their contacts to forward an authentication code.

“Actors may use social engineering techniques to convince you to disclose a 2FA code,” the bureau stated. “Doing so lets attackers compromise and take over accounts.”

Cybersecurity expert Jake Moore of ESET echoes the FBI’s concerns:

“Scammers often trick people into revealing OTPs to bypass security checks and take control. Even if someone claims to be from your bank, a trusted company, or even a family member, keep OTPs to yourself.”

This type of scam is especially dangerous because it preys on human trust—users are more likely to send a code if they believe the request is coming from someone they know.

Better alternatives: Authenticator apps and passkeys

To improve digital security, both the FBI and industry experts recommend using authenticator apps or passkeys instead of relying on SMS-based codes.

Authenticator apps (like Google Authenticator, Microsoft Authenticator, or Authy) generate time-sensitive codes on the device itself, meaning they are not sent through SMS and cannot be intercepted or forwarded.

Passkeys go even further. They link an account directly to a user’s physical device (such as a phone or laptop) using biometric data or a secure hardware token, making them significantly harder to steal or spoof.

Many tech companies, including Apple, Google, Microsoft, and major financial institutions, have already implemented passkey support across their platforms. Meanwhile, banks in countries like Australia and the United Arab Emirates are phasing out SMS-based 2FA entirely in favor of more secure authentication tools.

How to protect yourself from 2FA scams

If you still rely on SMS codes for two-factor authentication, it’s crucial to understand the risks and take the following precautions:

• Never share your 2FA or OTP code with anyone, no matter who is asking.
• Avoid clicking on links in unsolicited text messages or emails.
• Verify the sender by contacting the institution directly through their official website or phone number.
• Enable 2FA on all your accounts—preferably using an authenticator app rather than SMS.
• Use unique, strong passwords and consider a reputable password manager.
• Regularly check account activity for any unusual logins or changes.

By making small changes to your digital habits, you can significantly reduce your vulnerability to scams and protect your personal accounts from compromise.

Final thoughts

The FBI’s warning serves as a crucial reminder that while digital tools like 2FA are designed to protect users, they must be used correctly and cautiously. The real danger lies not in the technology itself, but in the ability of cybercriminals to manipulate people into bypassing their own safeguards.

As cybercrime continues to evolve, so must our approach to security. Upgrading from text-based authentication to more secure methods like authenticator apps or passkeys is not just advisable—it’s essential.

Source: Forbes – FBI Warns iPhone And Android Users—Do Not Share These Texts

The post FBI warns smartphone users to stop sharing 2FA codes in scam texts appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

Cybersecurity officials from the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued a warning about the Medusa ransomware, which has been active since 2021 and has recently impacted hundreds of individuals. citeturn0news18

What is Medusa Ransomware?

Medusa is a ransomware-as-a-service (RaaS) platform that first came to prominence in 2023. The ransomware impacts organizations running Windows, predominantly exploiting vulnerable and unpatched systems and hijacking accounts through initial access brokers. citeturn0search9

How Does Medusa Operate?

The Medusa ransomware gang has attacked over 300 victims in critical infrastructure sectors, according to U.S. cybersecurity agencies. citeturn0search5

Who Has Been Targeted?

Medusa has targeted over 300 victims in various sectors, including medical, education, legal, insurance, technology, and manufacturing. citeturn0news18

Recommended Protective Measures

To mitigate the risk of Medusa ransomware attacks, cybersecurity officials recommend the following actions:

• Update Systems Regularly: Ensure operating systems, software, and firmware are up-to-date to patch vulnerabilities.
• Enable Multifactor Authentication (MFA): Implement MFA for all services, especially webmail, VPNs, and accounts accessing critical systems.
• Use Strong Passwords: Employ long, unique passwords for all accounts and avoid password reuse.
• Educate Employees: Conduct regular training to recognize phishing attempts and suspicious activities.
• Secure Backups: Maintain offline, encrypted backups of critical data to ensure recovery without paying ransoms.

Implementing these measures can significantly reduce the risk of falling victim to Medusa ransomware attacks. Organizations are also urged to report any ransomware incidents to the FBI or CISA to aid in tracking and combating these threats.

Source: Cybersecurity officials warn against potentially costly Medusa ransomware attacks

The post Medusa Ransomware Warning: FBI and CISA Urge Caution appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

Beware: A Nationwide Smishing Scam is Spreading Fast

A dangerous text scam is sweeping across the U.S., and the FBI is urging smartphone users to stay alert. This fraudulent scheme, which tricks victims into thinking they owe money for unpaid road tolls, is rapidly moving from state to state. If you receive such a text, delete it immediately—leaving it on your phone increases your risk of falling victim.

Here’s what you need to know to protect yourself.

How the Scam Works

According to the Federal Trade Commission (FTC), scammers are impersonating toll agencies across the country, sending fake text messages demanding payment for supposed unpaid tolls. The messages contain a link to a fraudulent website designed to steal:

• Money — Victims who submit payments lose their funds to scammers.
• Personal Information — Clicking the link may expose sensitive data, such as your driver’s license number and other details that can be used for identity theft.

The FBI has received thousands of reports since March 2024, all describing nearly identical text messages. These messages:

Claim you owe money for unpaid tolls.
Contain a link impersonating an official state toll service.
Use phone numbers that change from state to state.

This scam is not limited to one region. In just the past month, reports have emerged from Massachusetts, California, North and South Carolina, Illinois, Colorado, Florida, Texas, and more.

A Growing Threat: FBI and Local Authorities Sound the Alarm

Local agencies across the U.S. are issuing warnings. One of the latest comes from Great Falls, which posted an alert on X (formerly Twitter) stating:

“This is a SCAM and is not coming from the City of Great Falls. Please do not click the link in the message.”

Similarly, the Oklahoma Turnpike Authority (OTA) recently cautioned residents about a new wave of scam texts, echoing the FBI’s advice:

Ignore the message and delete it immediately.

These scams are happening daily, with reports growing across different states. The simplicity of the attack makes it highly effective, targeting a broad audience and exploiting people’s fear of penalties or legal trouble.

Who’s Behind These Attacks?

Cybersecurity experts believe organized cybercrime groups, including Chinese hacking syndicates, are fueling this scam. These criminals:

Use sophisticated phishing kits to create realistic-looking fake websites that only function on mobile devices.
Have previously impersonated shipping companies, tax agencies, and immigration services to target vulnerable individuals.
Aim to steal payment card details and use them for fraudulent purchases or launder money through shell companies.

Renowned security investigator Brian Krebs highlights that SMS phishing attacks skyrocketed after New Year’s 2024, coinciding with the release of new phishing kits that mimic toll road operators’ websites.

How to Protect Yourself

Never click on links in unsolicited text messages. If you receive a toll-related text, verify it by visiting the official website directly or calling customer service.

Delete the text immediately. Keeping it on your phone increases the risk of clicking it accidentally.

Watch for red flags. Messages that contain incorrect names, odd URLs, or demand urgent action are often fraudulent.

Report the scam. If you receive one of these messages, report it to the FBI’s Internet Crime Complaint Center (IC3), including details of the phone number and website link.

What to Do If You’ve Been Scammed

If you’ve already clicked the link or provided payment details:

Secure your financial accounts — Contact your bank or credit card provider immediately.
Monitor your credit report — Be alert for any unauthorized activity or new accounts opened in your name.
Dispute any fraudulent transactions — Report the fraud to your bank or credit card company.

A Broader Epidemic of Text Scams

These toll scams are just one piece of a larger puzzle. Cybercriminals are using similar tactics to carry out banking scams, fraudulent tech support calls, and fake law enforcement threats.

For example, a woman in Florida was recently tricked by a scammer who convinced her that her phone had been hacked. She was instructed to withdraw thousands of dollars and deposit it into a “secure” cryptocurrency account—a classic scam tactic.

This problem extends beyond the U.S. In Europe, an energy company warned 1 million customers to delete fraudulent SMS messages impersonating their service.

Final Warning: Stay Vigilant

Never take unsolicited calls from banks or tech support.
Don’t install software or transfer money at someone’s request.
Ignore “official” messages from unknown numbers demanding payment.
Never click on unexpected toll payment links.

Following these simple rules will help you avoid becoming a victim of these increasingly common scams. Stay informed, stay cautious, and most importantly—DELETE suspicious texts immediately!

Source

The post New Text Scam Spreading Fast—Here’s How to Protect Yourself appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

The FBI and CISA (Cybersecurity and Infrastructure Security Agency) are urging Americans to prioritize secure communication methods, particularly encrypted messaging and phone calls, to protect against growing cyber threats. This comes amidst reports of a large-scale cyber espionage campaign targeting U.S. telecommunications networks, attributed to the Chinese hacking group Salt Typhoon.

The Problem with Cross-Platform Messaging

While messaging between Android devices or iPhones is secure, communication between the two platforms lacks end-to-end encryption, leaving it vulnerable to interception. Despite Apple’s recent adoption of RCS (Rich Communication Services), the lack of encryption in cross-platform messaging remains a critical security gap.

The FBI emphasizes the importance of using secure devices and communication methods. A senior official stated that the ongoing investigation into Chinese cyber activities has uncovered a broad campaign to compromise U.S. telecom networks. This campaign reportedly includes the interception of metadata and the private communications of individuals involved in government or political activities.

The Scale of the Threat

Salt Typhoon’s activities have heightened concerns about the vulnerabilities in U.S. critical infrastructure. During a classified briefing for U.S. senators, the group’s alleged deep penetration of American telecommunications networks was discussed, sparking calls for action. A Senate Commerce subcommittee is scheduled to hold a hearing on December 11 to address these security risks and explore best practices.

Recommendations for Secure Communication

In light of these threats, Americans are advised to:

1. Use Encrypted Messaging Apps: Apps like Signal and WhatsApp provide end-to-end encryption, ensuring that even if communications are intercepted, they cannot be decrypted.
2. Enable Timely Updates: Keep your phone’s operating system up-to-date to protect against vulnerabilities.
3. Use Phishing-Resistant Multi-Factor Authentication (MFA): Enhance security for email, social media, and collaboration tools.
4. Avoid Unsecured Messaging: Minimize the use of standard text messaging (SMS/RCS) for sensitive communication.

CISA’s officials recommend encrypted messaging and voice apps for all communications, stressing that encryption is a critical defense against cyberattacks.

The RCS Encryption Gap

RCS, positioned as the successor to SMS, still lacks full end-to-end encryption for cross-platform communication. While Google and GSMA (the mobile industry’s standard-setting body) have promised encryption for RCS, no timeline has been provided. Apple has remained silent on the issue, despite the irony of its growing encryption ecosystem.

Balancing Encryption and Law Enforcement

The FBI’s emphasis on “responsible encryption” reflects a nuanced stance. While advocating for secure communication, the FBI acknowledges the challenges encryption poses to investigations, as some platforms—like Signal and WhatsApp—cannot grant lawful access to encrypted content without compromising a device.

Choosing Secure Alternatives

Until encryption gaps in RCS are resolved, the FBI advises using fully encrypted platforms for cross-platform messaging:

• Signal: Offers robust encryption for messaging, voice, and video calls.
• WhatsApp: A widely used alternative with similar encryption features.
• Facebook Messenger: Now provides end-to-end encryption as an option.

Conclusion

In the face of increasing cyber threats, secure communication is more critical than ever. Americans are encouraged to adopt encrypted apps as their default for messaging and calls. Avoid standard SMS or RCS texting until these platforms implement comprehensive encryption. With secure alternatives readily available, it’s a necessary step to safeguard personal and sensitive information.

Source

The post FBI Alert: Why You Should Stop Using Regular Texts on Your Phone appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

As the holiday shopping season kicks off with Black Friday and Cyber Monday, the FBI has issued an urgent warning for online shoppers. Scam websites and fraudulent offers have surged by 89% compared to last year, with almost 80% of shopping emails now being scams. Even Google search results are being manipulated to direct users to dangerous websites.

For users of Chrome, Safari, and Edge—browsers that dominate 95% of the U.S. market—the FBI’s guidance is a must-read. Here’s how to protect yourself and avoid falling victim to online scams this holiday season.

Seven Key Tips to Stay Safe Online

1. Verify Website URLs
   Before making a purchase, ensure the website URL is legitimate and secure. Look for:
   • A padlock icon in the address bar.
   • The “https” prefix at the start of the URL.

   If the website appears suspicious or the URL looks off, move on.

2. Research Before Buying
   Always research websites and check reviews before making a first-time purchase. Be cautious, as reviews can sometimes be fake. Look for consistency across multiple sources.
3. Avoid Suspicious Marketplace Sellers
   On auction sites or marketplaces, beware of sellers with:
   • Mostly negative feedback or no reviews.
   • Few completed transactions.

   Stick to sellers with a solid reputation and favorable ratings.

4. Beware of Fake Authorized Dealers
   Avoid sellers claiming to be authorized dealers or factory representatives in locations where such dealers wouldn’t typically operate. These are often scams, shipping counterfeit goods or nothing at all.
5. Question Unusual Seller Claims
   Be cautious if sellers claim to reside in the U.S. but offer excuses—like being out of the country on business or handling a family emergency—for unusual shipping arrangements or overseas addresses.
6. Avoid Unconventional Payment Methods
   Never pay with direct money transfers, pre-paid gift cards, or agree to bypass customs checks. Use a credit card for added security and protection.
7. Say No to Gift Card Payments
   Scammers may request gift card PINs and codes instead of legitimate payments. Once they have these details, they’ll steal the funds, and you’ll never receive your purchase.

Cybersecurity Experts Highlight Growing Risks

The research team at Check Point echoes the FBI’s concerns, reporting a significant surge in fraudulent Black Friday-related websites. These scams mimic well-known brands but are rarely classified as safe.

Their additional safety tips include:

• Double-check URLs for typos or unusual domain names.
• Only trust sites with “https” and a padlock icon.
• Cross-check email senders with known sources before clicking any links.
• Avoid blindly scanning QR codes.
• Never share unnecessary personal information, like Social Security numbers or birth dates.

Examples of Fraudulent URLs to Avoid:

• Stüssy (Streetwear): stussycanadablackfriday[.]com
• Longchamp (Bags): longchampblackfriday[.]com
• Wayfair (Home Goods): wayfareblackfriday[.]com
• SOREL (Footwear): soreloutletblackfriday[.]com

Phishing Scams and AI-Driven Lures on the Rise

Bitdefender warns that 3 out of every 4 Black Friday-themed emails are scams, with many containing malware or phishing links designed to steal personal data. AI-crafted phishing lures are becoming increasingly sophisticated, mimicking trusted brands with ease.

These scams capitalize on urgency and enticing offers, making them harder to resist.

FBI’s Final Reminder

“Remember,” the FBI warns, “if it seems too good to be true, it probably is.”

Stay vigilant, double-check everything, and enjoy a safe holiday shopping season.

Source

The post FBI Issues Holiday Warning: Avoid These Online Shopping Scams appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.