Can a scammer intercept my text messages?

The SS7 protocol is the backbone of the global telephony network and has known security weaknesses that allow sophisticated actors — typically nation-state level or criminal enterprises with network access — to intercept calls and texts by targeting a specific phone number. This is not a threat most people face from opportunistic scammers; it requires resources and access unavailable to most fraudsters.

SIM swapping redirects all your calls and texts to a SIM the attacker controls. This is a more accessible attack available to any scammer who can socially engineer your carrier into performing the swap. Once successful, the attacker receives your SMS messages, including OTPs.

At the device level, malware (particularly stalkerware) installed on your phone can read your messages in real time and send them to a remote server. This is a significant risk in targeted situations, particularly domestic abuse contexts.

For iMessage users synced to iCloud, and Android users with Google Messages backing up to Google Drive: if your cloud account is compromised, your messages can be read remotely without touching your phone. Protecting your Apple ID or Google account is therefore also protecting your messages.

For sensitive communications, end-to-end encrypted messaging apps — Signal being the gold standard — are designed so that only the sender and recipient can read messages, with no interception possible even at the network level.