We have found mobile subscription services sending payment authorization messages in a format that lets phones and browsers offer the code for autofill. The message explains the charge, including how often it repeats, but someone can accept the suggested code without opening it. In the iPhone example we tested, the suggestion displayed an amount while leaving out the fact that it would be charged every week.
We use the name BillBait for misleading subscription journeys that use SMS autofill to let people enter a payment authorization code without opening the message containing the subscription terms.
At Gen Threat Labs, we have been examining subscription journeys in Poland, Switzerland, Denmark and Canada. Our investigation looks at the use of these autofill-formatted messages in services charged through a mobile operator, and how that changes the information people encounter when making a purchase.
Most of us are used to receiving codes by SMS. We enter them to sign into accounts, confirm transactions and prove that a phone number belongs to us. Having the phone retrieve the code saves us from switching between the message and the website, so accepting the suggestion can become as routine as entering the code ourselves.
For a subscription charged through a mobile operator, however, the message also explains the financial commitment associated with that code. Someone expecting a routine phone number verification may be authorizing a recurring payment.
Paying through a mobile account has been around for years. Premium SMS services have been used to buy content and pay for services. Although the billing arrangements differ, some subscription journeys involve entering a phone number on a website and confirming it with a code received by SMS.
The messages we examined use a format that associates the code with a website. Alongside the text intended for the customer, they include a machine-readable line containing the domain and the code. In the captured Polish message, that pair is:
@[REDACTED].com #2976
With the appropriate website and browser support, this allows the code to be offered for autofill. The domain helps the software determine where the code belongs, while the person can enter it without opening the message and rewriting it across.
Google’s guidance on SMS codes describes banks and card issuers using them as an additional security check during a payment. In the subscription journeys we examined, the code itself is the only authorization and verification to start recurring charges on the user’s mobile account. Someone who believes they are verifying their phone number may therefore be completing a step that authorizes a paid subscription. The SMS explains what the code authorizes, including the price and billing frequency, but autofill allows the person to enter it without opening that message. A code intended to confirm a financial commitment can then be handled as casually as a routine login code.
Figure 1. The subscription authorization SMS, displayed in Chrome's permission prompt, includes the bi-weekly charge and the domain and code used for autofill. Personal details have been redacted.
The code is intended for the website the person is visiting, so the domain check works as designed. Someone who thinks they are verifying their phone number can then use autofill to enter it without opening the SMS explaining that the code authorizes a recurring subscription.
Figure 2. The payment page states that the charge repeats weekly. The iPhone suggestion displays the code and amount without the billing frequency.
In this case the weekly charge remains visible higher up on the payment page. That page also includes a checkbox for accepting the terms and a button labelled "I order and pay". The pin code is inserted once you click the “From Mmessages 2976” button. What it does demonstrate is how the code can be entered without opening the SMS containing the payment explanation. A person concentrating on the suggested code sees an amount, while the weekly billing frequency has to be understood from information elsewhere in the journey. The text of the message is regulated and it has to contain all the information about payment, service name and unsubscribe information. On the other hand, the text on the webpage is commonly hiding this information behind the keyboard and using different font sizes to hide the payment details. The SMS message is the only part where the information can’t hide.
Chrome presents the message differently in the Android example. Its prompt asks whether the browser can read the SMS and enter the code, and displays message text stating that authorizing service costs 14.99 zł every week. The recurring charge is therefore available to read within the permission prompt itself. Unfortunately the wording and UI is pushing you not to read the message.
Affected users have also reported deceptive QR codes associated with parking payments and EV charging. In those settings, someone already expects to provide information and confirm a transaction, which can make a request for a phone number and an SMS code easier to accept as part of the task they came to complete.
The advertising that precedes a subscription request can also shape how someone interprets the code. One Polish advert we captured shows film posters above prominent instructions to "Verify your phone" and "Confirm your phone number to get full access". A charge of 14.99 zł every week appears in a much smaller line beneath the streaming banner. Someone following the most prominent instructions could reasonably approach the next step as a phone verification.
Figure 3. The advert emphasizes verifying a phone number to obtain access. The weekly price appears in smaller text beneath the streaming banner.
Other adverts we captured use large buttons labelled “Continue” or “Next”, with little explanation of the service being advertised. Someone trying to complete a task could mistake that button for part of the page they are using and click it simply to carry on, without expecting to be taken to a subscription offer.
That advert is a separate captured example from the previous one. Together, they illustrate two parts of the problem we are examining: how a request is presented to the customer, and how a payment authorization code is offered by the phone.
For anyone encountering these requests, opening the complete SMS before submitting the code is a useful precaution. Check that the service name matches what you intended to buy and that the amount is charged at the frequency you expect. If the message describes a subscription you were not looking for, stop there, even if the website has presented the code as a routine check.
If you discover an unfamiliar charge on your mobile bill, contact your operator through its official app, website or customer service number. Ask who is collecting the payment, how to cancel it and how to dispute the charge. Keep the messages and screenshots, and verify the cancellation instructions before following them. Some services use a STOP message, but blocking the sender or marking it as SPAM does not help, the charges will continue.
People who do not use premium services can also ask their operator about blocking them, checking separately what controls apply to third-party billing. The available options depend on the operator and country.
On the iPhone we tested, Apple’s autofill suggestion showed 14.99 zł without saying that the charge would repeat every week. Chrome displayed the full SMS, weekly charge included, but inside a browser prompt that carried Google's authority and was designed to be approved rather than read. Someone who clicked a misleading ad and was asked to verify their phone number could easily treat either prompt as just another verification step, without realizing that the code is actually authorizing a paid subscription to a completely different service.
Both companies should work with carriers and payment providers to investigate ways of identifying these messages and giving them a clear payment confirmation. Someone agreeing to pay 14.99 zł every week should see the service name and those recurring charges alongside the action they are being asked to confirm. Expecting people to spot the difference while encouraging them to enter codes with less effort leaves too much room for misleading subscription services.
