I recently got subscribed to some alerts by the mobile provider automatically and some amount deducted from my phone balance. I called up the customer care centre and they agreed to refund the amount, and said that it was activated from the internet, by some site which captured my number while browsing. Considering the customer care guy was right, isn't this a big security issue, if any website can access the phone number of their visitor?
3
-
1On the end of your provider definitively – if "any website can subscribe by specifying some phone number". From the Android end: did the browser ask your confirmation to provide certain data to the visited site? I often receive such popups for e.g. location or account requests.– IzzyCommented Feb 3, 2016 at 14:02
-
1As @Izzy says, did it ask for some confirmation? If yes, you most likely became a victim of WAP billing (more info).– Firelord ♦Commented Feb 3, 2016 at 20:19
-
@Firelord nope, no confirmation. I use adblocker on untrusted sites and never click on a suspicious popup or such stuff– gopi1410Commented Feb 4, 2016 at 4:51
Add a comment
|
1 Answer
It sounds like your customer care centre is telling you a story to get you off the phone. Some mobile phone providers have been caught out in the past passing your phone number in the HTTP request headers when you use their 3G connection from the phone. As you say, it's a huge security problem if they do that, and there's not a lot you can do about it (except change provider and tell them that's why).
You can check if this is happening to you by visiting a website that shows you your HTTP request headers. A quick Google search will find you at least a dozen to choose from. Make sure you use your 3G connection while doing this, because you're trying to see if your 3G provider is adding this data to your request.
It may be that the customer care person was claiming that the website is one you've deliberately told your phone number to, e.g. when shopping online. If they didn't tell you who originated the charge/junk SMS you have no way to verify this claim. Otherwise, most likely they are simply saying the most convenient thing. The entire mechanism of services which bill through your phone provider (via premium SMS, or the like) is horrendously insecure, but the carriers aren't interested in improving it. Any premium SMS company can just say any phone number they like to charge that number, and fraud is mainly detected by auditing afterwards (and when the carrier finds out via complaints like yours).
