A Scam Opener Delivered by a Carrier SMS Gateway

A mailbox at a municipal government agency received a message with no subject line, no display name, and no readable body. The From address was ten digits followed by @vzwpix[.]com, the domain Verizon uses to convert multimedia messages into email. Everything a triage queue normally sorts on was simply missing.

The content sat inside a nested message/rfc822 part that the automated extraction step could not open, so the incident reached review with an empty content field. Decoded by hand, that part held four sentences of small talk. The sender hoped the recipient was well and not working too hard, mentioned working on a Gospel project, and asked whether the recipient would be interested in reviewing it and offering feedback. It closed with a single first name. No link, no attachment, no request for money, credentials, or a change of payment details.

That is not a failed attack. It is the first move of one.

The Sender Was a Handset, Not a Mail Server

The gateway domain exists for a consumer convenience: a subscriber addresses a picture message to an email address instead of another phone, and the carrier repackages it as SMTP mail. The local-part of the resulting From address is not a mailbox anyone provisioned. It is the originating handset's own number, stamped on by the conversion service. Two relays inside the carrier's space handled the hop, an upstream multimedia-message host passing the converted mail to the carrier's text gateway, which delivered it into the recipient's Microsoft 365 tenant with no third-party relay in between.

Sender reputation does not survive contact with that arrangement. One domain is shared by every subscriber who has ever texted a photo to an email address, so its history carries no information about the person behind any single message. There is no apex domain to age, no registrant to look up, no lookalike to spot. Blocking the domain blocks a consumer channel wholesale. Accepting it is a blanket allow for a device pool numbering in the tens of millions, none of which can be individually authenticated.

SPF Passed Because It Was Built To

Each header result here is technically correct and analytically useless.

SPF passed. The carrier's gateway address is a permitted sender for the carrier's own gateway domain, so the check verified precisely what it is specified to verify: this server may send for this domain. It says nothing about who was holding the phone.

DKIM was absent entirely, and that absence is structural rather than suspicious. A DKIM signature requires a signer holding a private key for the sending domain, and nothing in the path from a handset through a carrier conversion service holds such a key on behalf of an individual subscriber. No signer exists, so no signature is applied, and there is no cryptographic route back to the originating device.

DMARC resolved as a best-guess pass with no action taken. The gateway domain publishes no DMARC record, so the receiving side inferred alignment from the SPF result rather than reading a policy. Under RFC 7489 a domain that publishes no policy gives receivers nothing to enforce, and a best-guess pass is the receiver's inference, not the sender's assertion.

One honest pass on carrier infrastructure, one structural absence, one heuristic guess. On a dashboard that renders as authenticated mail.

See Your Risk: Calculate how many threats your SEG is missing

The Wrapper That Broke Extraction Belonged to the Carrier

The nested message part is how the gateway packages a converted multimedia message. The attacker did not construct it. The carrier did, for every message it relays.

The defensive effect is identical to a deliberate evasion. The pipeline recorded the body as unavailable, so every content-derived signal (urgency scoring, lure classification, link and file analysis) had nothing to operate on. Manual decoding closed the gap, at analyst speed rather than delivery speed.

The tempting read is that a payload was hidden. It was not. There is no malware here and no credential harvester, and escalating an extraction failure into a claimed payload burns the credibility a real finding needs.

A Conversation Opener With Nothing to Block

The recovered text gives an inline control nothing to measure. It impersonates no brand, spoofs no colleague, references no invoice, and creates no deadline. A vague project, a warm tone, one low-cost question: are you interested.

That is the standard architecture of an advance-fee or confidence-fraud opener. The job of message one is to convert a cold address into a live correspondent. The actual ask, a review fee or a wire to a fictitious project account, arrives in message three or four, once the thread has a history and the target has already said yes to something small and free.

Reply-driven fraud is the expensive kind. The 2023 FBI IC3 Internet Crime Report put business email compromise losses near $2.9 billion in reported complaints alone, and the 2024 Verizon Data Breach Investigations Report names pretexting the leading social-engineering type, with the human element present in 68 percent of breaches. None of that begins with a payload. It begins with a reply.

Mapping to MITRE ATT&CK

• T1566 Phishing is the correct node, deliberately at the parent level. Neither the attachment nor the link sub-technique applies, because the message carried neither.
• T1598 Phishing for Information covers the observed behavior most closely: solicit a response, qualify the target, and learn who engages before spending any effort.
• The carrier gateway is a delivery-channel choice layered on top, substituting phone-network trust for domain reputation.

Indicators of Compromise

Where the Detection Actually Stood

Automated analysis raised a low-confidence anomaly, a little over 50 percent, and attached a classification naming a credential-theft pattern. Nothing in the recovered text asks for a credential, so that label does not hold. The incident was still open and unadjudicated, awaiting human review.

A thin, zero-payload message on an unusual channel produces exactly that: a hedged score and a label reaching for the nearest familiar shape. Content scoring cannot do better with almost no content.

What remains is relationship and channel. Is this the first contact from this sender? Has any mail ever reached this mailbox from a carrier gateway before? Those are the axes Themis, our Adaptive AI analyst, is built to weigh when the content layer is empty. And on a channel this sparse, a recipient who recognizes the pattern and reports it is often the first reliable signal available, which is why the human element belongs inside the detection loop rather than downstream of it.

The Takeaway

Carrier gateways are a real inbound channel with none of email's usual accountability, and most tooling treats them as an ordinary domain. Three practices follow.

Give the channel its own policy. Decide deliberately whether any business need justifies accepting converted mobile messages, and if the answer is no, that is a rule, not a reputation score. If the answer is yes, expect authentication results on that path to look clean every time.

Score thinness as a signal in its own right. First contact from an unknown sender, blank subject, no links, no attachments, and a body the pipeline cannot parse is an anomaly stack even when no single element is malicious.

Train for the opener rather than the ask. Someone who has seen the rapport stage described will report a friendly, harmless-looking message before the request arrives, which is the only stage at which this pattern is cheap to stop. Practical security awareness training targets that recognition directly. CISA's phishing guidance (https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one) and NIST's definition of phishing (https://csrc.nist.gov/glossary/term/phishing) are useful anchors for both the policy and the curriculum.