🛡️ Your polite reply to that text is worth $2 on the dark web

system · August 19, 2026, 9:50am

Your polite reply to that text is worth $2 on the dark web

Published: Wed, 19 Aug 2026 09:39:03 GMT
Tags: Mobile, Scams, Threat Intel

Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you’re willing to engage with strangers, making you a more valuable target for future fraud. Here’s why a polite response can be worth money to cybercriminals.

The politeness trap

Sunday night. You’re on the couch, half-watching Netflix, when your phone buzzes.

“Hey! Are we still on for dinner tomorrow? Don’t forget the wine ”

You don’t recognize the number. You glance at it for two seconds, then type what most polite people would:

“Sorry, I think you have the wrong number!”

You put your phone down. Go back to Netflix, and forget about it within five minutes.

On the other end, though, your reply has just told the sender something valuable. Not because of a technical exploit or an invisible cyber-attack, but because you just proved you’re the kind of person who responds to strangers politely.

According to cybercrime intelligence reports, responsive phone numbers are worth significantly more than inactive ones. With a single reply, you’ve entered a global criminal ecosystem run by transnational syndicates that, according to analysts, moves tens of billions of dollars.

What your reply told them

Let’s be clear: the “wrong number” text is not a phishing link. It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test.

The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email.

What they don’t know is whether you’re worth spending more time on. Your reply told them three useful things:

You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.
You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.
You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your timezone, and indicate how likely you are to respond to future messages.

The two paths your number takes

From this moment, your story splits. Both paths described below play out across millions of phones worldwide.

Scenario A: The slow burn

Within minutes of your reply, another message arrives in response to yours:

“Oh no, I’m so sorry! But honestly, you seem like a really kind person. It’s rare to find polite people these days. I’m Sarah, by the way.”

Some people stop the conversation there. Others reply out of curiosity or because they’re simply being friendly. A few messages later, you’re in a conversation.

In some large scam operations, those early exchanges may be handled by AI (Artificial Intelligence) using open-source language models such as Llama or Mistral. That allows scammers to hold thousands of conversations at once and focus their time on the people who seem most likely to keep talking.

While keeping you engaged, the AI assigns you a real-time vulnerability score based on your response time and message length. If your score crosses a certain threshold, a human operator takes over. They read the conversation, learn your name, your job, and your communication style, then continue as though nothing has changed.

Within two or three weeks, this person has become a friend. They text you good morning, ask about your day, and send photos stolen from real social media profiles.

Around week three, they casually mention an investment:

“I’ve been making really good money on an investment platform lately. Almost $4,000 last month. It’s crazy.”

If you show interest, they’ll send you a link to a fake trading platform with a convincing design. You might deposit $500 to test it. The next day, your dashboard shows a fake gain of $1,800, so you invest more. A week later, the platform disappears, along with your money, and the person who texted you every day.

According to the FBI’s Internet Crime Complaint Center (IC3), investment fraud generated more than $4.5 billion in reported losses in a single year. To be clear: while most wrong-number texts never reach this stage, victims who fall for so-called “pig butchering” scams (long-term romance/financial scams) suffer catastrophic average losses ranging between $70,000 and $75,000 per person.

Scenario B: The silent recycling

In this scenario, you replied “wrong number” and never heard from them again. You think you dodged the scam, but instead your number was simply moved to a different category: “Active, responsive, polite, but not susceptible to the wrong-number hook.”

That profile still has enormous commercial value. Your number is added to a cleaned database and sold or reused for a different campaign.

A week later you receive a text from another number:

“Hi! I saw your profile on LinkedIn. We have an opportunity that’s a perfect fit for your background.”

Or:

“Your package couldn’t be delivered, update your address by clicking here.”

Or a fake alert from your bank warning of “suspicious activity.”

You’ll probably never connect these messages to the wrong-number text you received the week before. They’re different topics and different senders. But they may all be part of the same criminal ecosystem. The first message was simply a way to sort potential targets. Everything that follows is the actual attack.

The most common hooks

If you’ve received one of these messages (or something very similar), you’re not alone. These are some of the most common opening lines used in wrong-number scams, tested on millions of people and optimized to maximize response rate:

The friend who doesn’t exist:

“Hey! See you tonight at 6? Don’t be late ”
“Are you still free tomorrow?”
“Did you send those files to the office?”
“Hey Marco, are we still on for dinner tonight?”

The concerned neighbor:

“Sorry to bother you, I’ve noticed your dog sometimes runs into my yard.”
“I found a phone number on the dog tag, is this yours?”
“Hi, your package was delivered to my address by mistake.”

The professional mix-up:

“Hi, I tried to reach you about the delivery but you didn’t answer.”
“The shipment arrived at your address, can you confirm?”
“This is Mike from the office, did you get my earlier message?”

The family emergency:

“Do you know Sarah? There’s been an emergency.”
“Is this [common name]’s number? Something happened.”

The recruiter:

“Hi! I came across your profile, we have an incredible opportunity.”
“Hey, I’m reaching out about a position that matches your background perfectly.”

If you’ve received one of these messages, it doesn’t automatically mean it’s a scam. People genuinely do text the wrong number sometimes. But if the conversation quickly moves to making small talk, asking personal questions, or encouraging you to keep chatting, stop replying.

Don’t recognize that number? We’ll check it.

CHECK NOW

The crime industry behind the text

These messages aren’t usually sent by a lone cybercriminal. They’re part of a highly organized criminal industry with its own market dynamics and global supply chains.

In January 2026, Cambodian and Chinese authorities arrested Chen Zhi, president of Prince Holding Group, accusing him of running a network of scam compounds across Southeast Asia where thousands of trafficked people were forced to manage these conversations. Those operations relied on underground marketplaces where criminals could buy everything they needed, from phone lists and stolen identities to AI tools and fake investment websites.

The scale is staggering. Blockchain analytics firm Elliptic estimates the Huione Guarantee underground marketplace processed more than $134 billion in transactions. Separately, researchers at the University of Texas at Austin estimate that pig-butchering scams stole more than $75 billion in cryptocurrency over four years.

The scam funnel: Costs and revenue

To understand why this ecosystem is so huge, look at the math. Sending hundreds of thousands of text messages costs very little. Even if only a tiny fraction of people reply, and an even smaller number eventually send money, the profits can far outweigh the costs.

Look at this illustrative model of a campaign sending 100,000 SMS messages:

100,000 SMS sent (Cost: ~$200) > 15% reply

AI manages 15,000 conversations (Cost: ~$30) > 20% keep chatting

3,000 passed to human scammers (Cost: Near zero due to forced labor) > 10% enter investment scam

45 victims send money (average $5,000 per victim)

------

Estimated revenue for scammers: ~$225,000

The figures in this model aren’t arbitrary. They combine observed pricing from underground marketplaces such as Russian Market and BidenCash with average victim losses reported by law enforcement agencies, including the FBI’s Internet Crime Complaint Center (IC3).

Even allowing for variation between campaigns, the economics are compelling. A single campaign can cost less than $1,000 to run while generating more than $200,000 in revenue, representing a potential return on investment (ROI) of 90x to 200x.

Those same economics are reflected in underground marketplaces, where verified, enriched contact details command significantly higher prices than raw data. In our previous investigation into underground marketplaces, we found that a typical stolen personal record sold for around 95 cents. The more criminals learn about a potential victim, the more valuable that person’s data becomes.

The price ladder of your phone number:

.kb-table-container445707_d29b97-2a{overflow-x:auto;}.kb-table445707_d29b97-2a tr > *:nth-child(2){width:21%;}.kb-table445707_d29b97-2a{table-layout:fixed;width:100%;}.kb-table445707_d29b97-2a tr{height:0px;}.kb-table-container .kb-table445707_d29b97-2a th{padding-top:var(–global-kb-spacing-xxs, 0.5rem);padding-right:var(–global-kb-spacing-xxs, 0.5rem);padding-bottom:var(–global-kb-spacing-xxs, 0.5rem);padding-left:var(–global-kb-spacing-xxs, 0.5rem);text-align:left;}.kb-table-container .kb-table445707_d29b97-2a caption{text-align:center;}.kb-table-container .kb-table445707_d29b97-2a td{padding-top:var(–global-kb-spacing-xxs, 0.5rem);padding-right:var(–global-kb-spacing-xxs, 0.5rem);padding-bottom:var(–global-kb-spacing-xxs, 0.5rem);padding-left:var(–global-kb-spacing-xxs, 0.5rem);text-align:left;}.kb-table-container .kb-table445707_d29b97-2a td, .kb-table445707_d29b97-2a th{border-top:2px solid #CCCAD7;border-right:2px solid #CCCAD7;border-bottom:2px solid #CCCAD7;border-left:2px solid #CCCAD7;}@media all and (max-width: 1024px){.kb-table-container .kb-table445707_d29b97-2a td, .kb-table445707_d29b97-2a th{border-top:2px solid #CCCAD7;border-right:2px solid #CCCAD7;border-bottom:2px solid #CCCAD7;border-left:2px solid #CCCAD7;}}@media all and (max-width: 767px){.kb-table-container .kb-table445707_d29b97-2a td, .kb-table445707_d29b97-2a th{border-top:2px solid #CCCAD7;border-right:2px solid #CCCAD7;border-bottom:2px solid #CCCAD7;border-left:2px solid #CCCAD7;}}

.kb-table-container .kb-table tr.kb-table-row445707_c65fe3-3f{background-color:rgba(0,89,255,0.17);height:48px;}

Lead Type	Price	What Triggers It
Raw phone number (unverified, from old breach)	$0.01 – $0.05	Your data leaked years ago
Confirmed active number	$0.50 – $2.00	You replied “wrong number”
Enriched with profile data (name, job, income estimate)	$1.00 – $5.00	OSINT scripts scraped your socials
“Hot lead” (psychologically vulnerable, lonely, engaged)	$6.00 – $10.00	You chatted for 3+ days, showed openness

That’s a 4,000% value increase generated by a single polite reply.

From there, scammers can enrich that record with publicly available information such as your name, employer, social media profiles, and estimated demographics using automated open-source intelligence (OSINT) techniques.

The more complete the profile becomes, the more valuable it is. Researchers monitoring underground marketplaces have found that enriched, pre-profiled contacts command premium prices because they’re more likely to become victims of high-value pig-butchering scams that generate billions of dollars in illicit revenue each year.

How do they know who you are?

Before that text reaches your phone, your number may already have passed through automated script pipelines capable of cross-referencing tens of thousands of records in minutes.

Acquisition: Your number is pulled from historical data breaches, such as the Facebook leak affecting 533 million users, Twitter/X data leaks, or massive aggregated databases like Naz.api, and the Mother of All Breaches (MOAB), a collection of more than 26 billion records compiled from thousands of previous breaches.

Automated scraping: Software queries public sources to check whether your number is linked to an active WhatsApp account, collect your profile information and picture and match the number to public LinkedIn, Instagram, and Facebook profiles.

Data broker integration: Scammers exploit the same commercial data services used by marketing companies to associate a phone number with estimated age, address, and income bracket.

The result is a psychographic and commercial profile that helps scammers choose the most convincing approach. If your social media shows you have a dog, you might receive the neighbor hook: “Your dog keeps getting into my yard.” If you recently changed jobs on LinkedIn, the fake headhunter hook activates.

The human factor: Modern slavery

There’s one aspect of these scams that’s often overlooked: many of the people sending the messages are victims themselves.

In its August 9, 2023 policy report, the United Nations Office on Drugs and Crime (UNODC) described a human rights crisis tied to forced criminality in Southeast Asia. It estimates at least 120,000 people in Myanmar and tens of thousands in Cambodia are being held in fortified mega-compounds run by criminal syndicates.

Many were lured by fake job adverts promising legitimate work in digital marketing or customer service. Once they cross the border, their passports are confiscated. They were stripped of freedom and forced, under the threat of violence, to spend up to 16 hours a day managing dozens of scam conversations. Those who failed to meet financial targets were often beaten, isolated, or sold to other compounds.

When you reply to one of these messages, you’re interacting with a system designed to simultaneously exploit your financial availability and the enslavement of another human being.

Breaking the chain

You can’t erase your number from dark web databases: that damage may have done years ago. But you can make your profile far less valuable to scammers.

Make yourself harder to profile: Review the privacy settings on any messaging apps and social media platforms that use your phone number. Limit who can see information such as your profile photo, status, last seen, and phone number. The less information scammers can gather automatically, the harder it is to build a detailed profile about you. On WhatsApp, for example, you can set Profile Photo, About, Status, and Last Seen to My Contacts. On Telegram, set Phone Number to Nobody.

Report before you block: Blocking protects only you. Reporting protects everyone. When you use WhatsApp’s Report and Block function, the last five messages in the chat are sent to Meta’s security teams. If enough people report the same number, it may be permanently banned, destroying the entire active campaign on that line.

The golden rule: If you receive an unexpected message from an unknown number, the safest response is no response at all. Don’t reply, don’t explain yourself, and don’t worry about seeming impolite. If it’s a genuine wrong number, the sender will usually realise their mistake and move on. If it’s a scam, you’ve denied the criminals exactly what they wanted: proof that your number is active and that you’re willing to engage.

Something feel off? Check it before you click.

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.

Try it free →

Source — malwarebytes

Read Full Article
Published: Wed, 19 Aug 2026 09:39:03 GMT

Category — CYBER

Region: malwarebytes | Section: CYBER

Related: cyber • malwarebytes • mobile • scams • threat-intel