The “Hi Mom!” phishing scam: How to recognize and avoid it
Have you ever received a call for help or a strange text message claiming from your son or daughter? But strangely, you don't recognize the number? Be careful: the “Hi Mom” scam shows no sign of stopping in 2024.
by Alyssa SchmittHow can you know who’s really behind that strange text message you just received? “Hi Mom, this is my new number. Can you save it and send me a message on WhatsApp as soon as you see this?”
“Hey Dad, I’m in trouble. I lost my phone and need money – please text me at this number.”
“Hey Mom! So embarrassed – dropped my phone in water and it’s completely dead. Am borrowing a friend’s phone but need your help. Please send a WhatsApp when you get this.”
If you don't have kids, then you immediately know that a text or WhatsApp message like this from an unknown number can only be a scam. But if you’re a parent, there may be an initial moment of surprise or even shock. Full of worry for your child, you quickly reply to the text message or send a WhatsApp message to the new number. And that’s when your troubles really start. Because responding to this strange number lets the sender know that your number really exists and is actively used – and that there is a concerned parent on the hook.
Scammers have learned that one of the surest ways to trick people is to appeal to their emotions by faking an urgent situation. The “Hi Mom/Hi Dad” scam begins with a text message from an unknown number pretending to be from their child. The recipient is told that their family member has lost or broken their phone and is trying to contact them on a borrowed one – a realistic and believable scenario. The scammer usually asks their victim to save the number and contact them using a messaging platform such as WhatsApp (which are end-to-end encrypted and therefore harder to trace).
Once you have replied to the text as requested, the next request will usually be for money, or for help in making a payment:
“I need to pay for a new phone – can you send money to me via this link? I promise I’ll pay you back next week.”
“I have to make a payment but I don’t have the banking app set up on this phone – can you text me the code that was sent to your phone?”
As you can guess, in the first example, the scammer is trying to get the victim to sent them money. In the second, they are trying to log into one of the victim’s online accounts and need the two-factor authentication code sent by the bank to access it.
“Imposter scams,” in which the scammer imitates a trusted institution such as Social Security or your bank, have been around for a while now. The aim is to establish contact and win your trust so they can succeed in a money scam or steal your personal data. In these scams, the imposter will reach out using a phishing email, a text message, or even a phone call. The “Hi Mom” scam is a new version of the “grandparent scam” in which the scammer targets seniors by pretending to be a grandchild asking for money due to an emergency. Fake messages from a child or grandchild have proven especially effective for imposter scammers because people naturally want to help when they believe a loved one is in distress. If you believe you’ve been targeted by an imposter scam, in the United States you can file a report with the Federal Trade Commission or the FBI.
Even though the exact wording will differ – and sometimes take the form of a “Hi Dad” text – these fake messages do follow a pattern. The following clues can point to a scam text:
The sender has an unknown cell phone number
The message describes an urgent or emergency situation and requests immediate help
The message is not signed with your child’s name
A creative reason is given for the strange cell phone number e.g., “I dropped my cell phone in a pool.”
You are asked to reply on a messaging application such as WhatsApp
Once you reply to the message, you are asked to transfer money
The messages often contain spelling mistakes or grammar mistakes
If you receive a suspicious “Hi Mom” text, the most important thing is not to reply to the unknown number or call it. If you would like to check in with your child and make sure everything is ok, it is best to call them directly on their landline number (if they have one) or the “old” cell phone number. If you can’t reach them, you can also check with another family member, e.g. the child’s sibling or other parent, to see whether there is actually a problem. In addition:
Under no circumstances should you transfer any money, send a gift card, share a security code, or allow yourself to be pressured into any other actions.
With a little planning, there is an easy way to find out if the person contacting you is really your loved one – an anti-imposter code word. All you need is a specific question or phrase that your family member would know but a criminal wouldn’t. Your family could agree on a word, like “Carrot,” and then if you think there really is a chance you are actually being contacted by your child, you could simply ask the person texting you “What’s the code word?”
If you have not agreed on a code word in advance, you could still verify their identity by asking a question that the imposter wouldn’t know the answer to, like “What color is the bathroom rug?” However, it can be hard to come up with good questions on the fly when you are stressed out, and if you pick something you have posted about recently on social media, like “Where did we spend our vacation?”, there is a chance the scammer might know. So if you’d like to use this method, it’s best to give it some thought before the scam text or phishing email arrives.
Scammers often look for contact information like cell phone numbers and email addresses on social media platforms and public internet forums. They also look at social media feeds to find personal information and references that will allow them to tailor convincing scam and phishing messages to you, as in a spear phishing attack. For this reason, you should:
Limit the personally identifiable information you post publicly on social media and dating apps
Check your privacy settings on social media and make sure that only your friends and family can see your personal feed
Don’t post your private cell phone number and/or email address where the public can see them
Activate two-factor authentication for online banking or any online accounts where you have saved payment information, e.g. credit card numbers
We hope this post will help keep you safe from scam text messages. If you found it helpful, please take a moment to give us some feedback below! And if you still don’t have a mail.com account, why not sign up for free today?
