Weird number spoofing MMS messages received

Murmansk

I've received recently a number of messages which SEEM to be from a person I've been doing some work for but are not really from him.

They are received by SMS and appear to be multimedia messages which I can only access via a link in the message which takes me to an EE web page, where I log in using my mobile number and a password which comes to me via a second text message. 

The message I eventually see upon logging in contains my name and the address of the place where I've been doing the work and says something like "are you OK for tomorrow [MY NAME]?"

So somebody seems to have access to my client's phone messages (so he can see my name and the address of the property) and be able to spoof the client's phone number and send messages that seem to be from him. What puzzles me, as much as how this is done, is why bother?!

datz

Murmansk said:

I can only access via a link in the message which takes me to an EE web page, where I log in using my mobile number and a password which comes to me via a second text message.

The obvious question is: are you sure you are on the legitimate EE website? Sounds to me like a data breach on your client's side, and maybe this is step 1 of a more complex scam or scenario yet to unfold.

tacpot12

Have you warned your client? I would do so asap. 

marcia_

 And change your EE password as you may have we been on a spoof website 

MalMonroe

Why bother is they want your money. That's always the reason.

I'd contact your client asap and let them know about this because they may be receiving or sending spoof messages that they're unaware of - and may be about to be scammed.

Then I'd block that number and ask the client to contact me via another means. It appears that there's a hacker somewhere using a spoofed or cloned phone number on your client's phone. It's easy to do if you're a crook. (I'm not, I hasten to add!)

I agree with datz, above, it could be the first step of many in a complex scam. Don't fall for it. 

Murmansk

I've told the client and he is well aware of it. The link did look very much like a genuine EE website and the one-time password that came in the next message worked on the site - I've seen this kind of double text with link and password before when someone's sent me an MMS message, so I think that's a side effect of my phone not accepting MMS messages rather than something the sender has engineered.