“SMiShing” – Mobile Phone Scams supported by EE?

SMiShing (SMS phishing) is a type of phishing attack where mobile phone users receive text messages containing a Web site hyperlink, which, if clicked would download a Trojan horse to the mobile phone.



I have been receiving regular text messages for some time now, saying “You subscribed to Clicnscore for £4.50 per week from ClicNScores until you text STOP” – bad English I know. I had another message from “Loaded Mobi”- “You can access the games portal here” followed by a link.

Thinking both were merely “SMiShing, I clicked on neither STOP nor the link. Unfortunately our phone bills go straight to our Accountant, but I had cause lately to query a bill I thought was high. It turns out both of these companies have been regularly paid through my EE account.

EE informed me it was not there responsibility & gave me text links to cancel subscriptions & phone numbers to complain & ask for a refund. Both numbers are automated, ClicnScore gives you a message “there are no charges to your phone” – then cuts you off, Loaded Mobi puts you in a call queue then cuts you off.

I have since searched these 2 companies on the internet, they have been investigated on Watchdog, reported on BBC, The Express & Mail Newspapers. The Sun Newspaper first reported this back in the 19th of May 2016.

EE say while they are aware, had so many complaints & have investigated, they still have no responsibility as you have the option to block all payments from your account. Shouldn’t EE be at least protecting our accounts against such well publicised Common Scams? It would be so simple for EE to set up authentication, so why not take responsibility for Customer Data & Accounts – have they a vested interest?

Perhaps merits an ICO investigation? I’ll certainly report!

GDPR for the 25th May, ISO 27001 for Life?

With the many GDPR offerings & associated fear mongering out there, businesses would be forgiven for forgetting there has always been a legal requirement on the use and protection of Personal Data – The Data Protection Act. In fact, the ICO (Information Commissioner’s Office) has been tracking down & levying fines on many shady companies that have abused personal data for many years. Nobody is above the law, even Humberside Police have been fined £140 000 & the Royal Mail Group £12 000:

5th April 2018 – Humberside Police has been fined £130,000 by the Information Commissioner’s Office after disks containing a video interview of an alleged rape victim went missing.

6th April 2008 Royal Mail Group Limited has been fined £12,000 by the Information Commissioner’s Office after sending more than 300,000 nuisance emails. On two dates in July 2017, the company sent emails to 327,014 people who had already opted out of receiving direct marketing.

ICO Actions Taken

The introduction of GDPR while protecting individuals & clarifying the requirements for business in my opinion has best served to re-focus on the need to protect information, but don’t lose focus – While the loss or mishandling of Personal Information can lead to one of the above fines, the careless handling of Business-Critical Information could affect the loss of your business.

Long term I would recommend you incorporate all of your business in an Information Security Management System. Information Security isn’t just for the 25th May it is for the whole year and your entire Business. Use ISO 27001 guidance to set up an Information Security System that protects your whole business & ISO 27001 Certification to demonstrate Due Diligence & give potential customers that warm cosy feeling –

FURTHER INFORMATION