The principle and utilization of RCS SMS protocol phishing

introduction

With the evolution of mobile communication technology, Rich Communication Services (RCS), as an upgraded version of SMS (Short Message Service), has become the mainstream messaging protocol on Android and iOS devices. It supports rich media (such as images, videos, buttons, and hyperlinks) and provides end-to-end encryption (E2EE) in some implementations to improve user experience. However, this “upgrade” also opens new doors for cybercriminals. RCS phishing attacks (Phishing via RCS) take advantage of the rich functionality and encryption features of the protocol to create more realistic and deceptive fraud messages. According to a 2025 security report, RCS-related phishing attacks have led to the leakage of millions of credit card information around the world, with a success rate as high as 5%, far exceeding the 2% of traditional SMS. This article will provide an in-depth analysis of the principles, utilization methods, real cases of RCS phishing, and discuss prevention strategies to help readers understand this emerging threat.

Figure 1: Schematic diagram of phishing attack sequence (Source: ResearchGate). The figure shows the typical flow from fake website to induced clicks, suitable for RCS scenarios where hyperlink messages replace traditional SMS links.

Introduction to RCS protocol

RCS is an IP-based messaging standard promoted by GSMA (Global System for Mobile Communications Association) and aims to replace the backward SMS/MMS. It is transmitted over data networks and supports:

• rich media content: Embed images, videos, location sharing and interaction buttons.

• End-to-end encryption: As implemented in Google Messages, messages are encrypted in transit.

• Sender verification: Brand identity (Verified Sender) is partially supported but not mandatory.

Unlike SMS, RCS messages are more like chat apps (such as WhatsApp), but it still relies on the carrier network, and encryption hinders real-time scanning by the carrier. This is a breeding ground for phishing attacks - attackers can send rich messages disguised as legitimate and difficult to intercept.

The principle of RCS fishing

The core principle of RCS fishing isLeveraging the protocol’s trust mechanisms and rich features to bypass traditional defenses. Traditional SMS phishing (Smishing) relies on plain text links, and users click on them to jump to malicious sites. RCS is more insidious because it inherits the ease of forgery of SMS (numbers can be impersonated at will), and at the same time amplifies the seductive power of rich media.

Core principles

1. Encryption to avoid detection: RCS E2EE prevents carriers or network filters from scanning content. SMS is in clear text and is easily intercepted by blacklists; after RCS encryption, the attack message passes through "invisibly".

1. rich media disguise: Attackers can embed brand logos, buttons (such as "Pay Now") and hyperlinks to create a sense of urgency. For example, a message disguised as a bank could include a "Your account is abnormal, click to verify" button, directly guiding the victim to enter credentials.

1. Sender spoofed: Although RCS has verification options, it is not mandatory by default. An attacker can spoof a number or brand ID, similar to SMS Caller ID Spoofing.

1. interactive induction: RCS supports receipts and conversation flow. The attacker first sends a "confirmation message" to induce the user to reply "Y" to "activate" the session, bypassing the App's anti-spam rules.

These principles are combined with AI-generated content (such as ChatGPT fake messages) to make the attack more precise. During the X platform discussion, security experts pointed out that RCS is no more resistant to phishing than SMS, and is even more dangerous because of its hyperlink support.

Figure 2: Phishing message generation flow chart (Source: ResearchGate). In RCS, this process extends to rich media injection, where attackers automate the entire process from forging content to distributing it.

How to use RCS phishing

Attackers achieve large-scale exploitation through Phishing-as-a-Service (PhaaS) tools such as "Lucid". These tools are hosted on platforms like Telegram, with subscription fees as low as hundreds of dollars per month.

Common exploit techniques

1. Time limit URL: Generate a single-use link, which will redirect or become invalid after expiration. Only load phishing pages when accessed from RCS short links to avoid static scanning.

1. Geographic/device targeting: Customize content based on user IP or device type. For example, fake "European Union Post" package notifications for European users.

1. Scaling up mobile phone farms: Attackers used dozens of devices to send mass messages, rotating numbers and domain names to avoid blacklists. Android RCS is susceptible to this due to its open source nature.

1. brand imitation: Copy the UI of postal, express, and financial institutions, including icons and domain names. Messages such as: "Your package is delayed, click to pay the shipping fee" - the user enters the card number and it is stolen.

1. Multi-channel collaboration: PhaaS supports role division (administrators monitor real-time data), tracking click-through rates and successful conversions.

Recent discussions on

Real case analysis

In March 2025, the "Lucid" tool was exposed: the Chinese phishing group "XinXin" used RCS/iMessage to disguise 169 organizations, covering 88 countries. Example:

• Attack example: An RCS message: "Warning for unpaid tolls, click to pay to avoid fines." After the user clicks, he enters the fake bank page and enters his credit card information.

• effectiveness: Within a week, 30 cards were stolen in 550 visits, with a success rate of 5.45%. An average of 100,000 card numbers are harvested globally every day.

• Influence: Financial losses to victims, identity theft; brand reputation damage. Europe and the United States are the hardest hit areas.

Another case: the RCS micro-scam reported by Hiya. The attacker sent a small "refund confirmation" message to induce click verification, leading to account takeover.

prevention strategies

RCS phishing is tricky, but can be mitigated through multiple layers of defense:

1. client: Enable RCS verification (such as Google's Verified RCS) to avoid clicking on unknown links. Use independent encryption from apps like Signal.

1. Carrier grade: Mandatory sender ID verification and promotes GSMA standard upgrade. Deploy AI content scanning despite encryption challenges.

1. Tool protection: Install anti-phishing apps (such as MetaCert’s Zero Trust SMS) to verify URLs in real time.

1. educate: Be wary of rich media messages and prioritize voice/video identity verification.

Expert advice: Although RCS is better than SMS, it requires a "zero trust" mindset.