Apple’s iPhone is one of the “must-have” personal communication devices of the decade and it is certain to be the chosen mobile of football fans flocking the 2010 World Cup in South Africa. Unfortunately, its popularity makes it a target of the cybercriminals.

Symantec researchers have recently observed phishing scams targeting iPhones to gain serial numbers, IMEI (international mobile equipment identity), model, capacity, etc. According to Symantec’s Mathew Maniyara, an IMEI is a 15-digit unique number used by GSM networks to identify valid devices.

“Every GSM, WCDMA, or iDEN mobile phone (and even the odd satellite phone) has an IMEI. It can be found under the battery of the device or by typing *#06# on the mobile.

“If your phone or device is lost or stolen you can report it to your service provider, providing the IMEI number. The service provider can then blacklist the IMEI number, rendering the device unusable in that country.”

Why the IMEI number?

A device with a blacklisted IMEI is unusable in that country. There is no restriction on having the same IMEI number for two devices. So, scammers can simply steal the number from other users who have valid or working IMEIs and copy it to the stolen device. Scammers can then use the stolen device or even sell it.

How are IMEIs stolen?

Scammers have been creating phishing sites that make the claim that a free one-year warranty extension for a certain mobile device or devices is available. To obtain the (fake) offer, users are asked to provide their device information, including serial number, IMEI number, type of phone, and so on. Below is an example of such a phishing scam:

Once the scammers gather the iPhone information for valid devices, they replicate it to the stolen devices. “The process of changing the device IMEI isn’t difficult to perform. It can be done by installing some drivers onto a system that is connected to the mobile device through a USB cable, without the use of any external devices,” Maniyara says.

“This way they can convert the device information to any set of data that they choose. Giving out device information can be dangerous because criminals can use such info to perform illegal activities. Therefore, it is recommended that users remain wary and use caution when it comes to these types of scams.”

Protection tips

Internet users are advised to follow best practices to avoid phishing attacks. Here are some basic tips for avoiding online scams:

  • Do not click on suspicious links from e-mails.
  • Check the URL of the website and make sure that it belongs to the brand.
  • Type the domain name of your brand directly into your browser’s address bar rather than following any link.
  • Frequently update your security software, such as Norton Internet Security 2010, which protects you from online phishing.