Spoofed Texts Can Infiltrate Existing Conversations Undetected, Security Study Finds

Researchers Found That Email-to-Text Gateways Could Let Attackers Spoof Trusted Text Messages

At this point, getting a sketchy text is practically a daily occurrence. Fake package alerts, bogus bank warnings, or scam links just to name a few. Most people have learned to treat unexpected texts with suspicion. Even with all that skepticism abound, researchers at UC San Diego and Carnegie Mellon University found a way to make fake texts look completely convincing anyway, slipping them directly into existing conversations with real contacts.

Working on real phones across real carrier networks, the team demonstrated that systems bridging email and text messaging had serious security gaps that could let attackers fake nearly any sender identity. In their tests, phone numbers, short codes used by banks and delivery services, and text-like names such as “Chase” could all be spoofed across a range of carrier and device combinations, though the exact attack varied by carrier, gateway, and device type. Spoofed messages could also be inserted directly into existing text conversations, sitting alongside real messages as though they belonged there. Presented at the 2026 IEEE Symposium on Security and Privacy, the study received a Distinguished Paper Award.

Email-to-Text Gateways Had a Spoofing Problem

Major U.S. carriers have offered email-to-text gateway services for decades. Verizon’s launched in 2001. Email and text messaging operate under completely different rules for identifying senders, and the bridge between the two is where things went wrong.

To run their tests, the researchers bought active service and SIM cards from each major carrier, then sent carefully crafted emails to each gateway and watched what arrived on the receiving phone. Each carrier handled the translation differently, and each had its own weak point. Some gateways checked one part of an email for authentication but displayed a completely different part as the sender, meaning an attacker could pass the security check while slipping a fake identity through the front door.

Others simply failed when a key piece of sender information was missing, filling in the blank with whatever unverified text the attacker supplied. One gateway accepted anything the attacker typed as the sender identity, with no checks at all. All told, the team developed nearly 125 different spoofing techniques to probe each gateway and published the full code alongside their paper.

Phone Software Made Spoofed Texts Even Harder to Spot

Getting past a carrier gateway was only half the problem. Both Apple’s iOS and Google’s Android also contained bugs in the software responsible for reading and displaying incoming messages, and those bugs made the attacks significantly more convincing.

On iPhones, a quirk in Apple’s core messaging software caused it to misread specially formatted email addresses as real phone numbers or trusted names. A related issue caused iOS to treat certain invalid email addresses as plain text, so a fake sender could display simply as “Chase” or a string of digits that looked exactly like a legitimate phone number. Researchers traced this behavior in Apple’s software to at least 2012.

On Android, the Google Messages app had its own flaw. Its built-in rule for recognizing email addresses required the domain portion to end in letters. A numeric-only email address, which is technically allowed under standard email rules, tripped that check and got reclassified as a phone number, with the characters that would have revealed it as an email quietly stripped away. A version of that same bug appeared in Google’s messaging app as far back as 2016.

Spoofed Messages Could Slip Into Existing Text Conversations

Perhaps the most alarming capability the researchers demonstrated was inserting a spoofed message directly into an existing conversation. Messaging apps automatically group all messages from the same contact into one thread, regardless of how those messages arrived. A fake message with the right sender identity would simply appear inside an ongoing conversation, indistinguishable from the real ones around it.

On iPhones, this was especially easy to exploit. Apple Messages folded messages from all of a contact’s phone numbers and email addresses into a single thread without indicating to the user which channel a given message came from. An attacker needed only to spoof a contact’s email address, and the fake message would land right inside the real conversation. Android handled this more carefully, keeping separate threads for different contact methods even when they belonged to the same person.

Carriers and App Makers Addressed the Vulnerabilities After Disclosure

All four major U.S. carriers had either deployed fixes or shut down their email-to-text gateways before the paper was presented, according to the researchers. Google released a patch for the Messages app, and Apple addressed one of the iOS vulnerabilities, assigning it a CVE. Additional Apple fixes for related issues were expected in future releases. Researchers also notified the GSM Association, which planned to update security guidelines for network operators worldwide. Limited follow-up testing in Canada found similar vulnerabilities in at least one carrier’s gateway, leaving open questions about how broadly the problem extended beyond U.S. borders.

Trust in text messages has always rested on an assumption that turned out to be shakier than anyone realized. What this research exposed is that for well over a decade, the gap between email and texting was wide open.

---

Disclaimer: This article is based on peer-reviewed research and is intended for informational purposes only. The vulnerabilities described were responsibly disclosed to affected carriers and app makers, and fixes were deployed prior to publication of the research. Readers should ensure their devices and apps are running current software updates.

---