Detecting Payment Fraud: Why Telecom SMS Spoofing (+16247) Happens & Prevention

If you sell products online or trade on P2P platforms like Binance in Bangladesh, you have almost certainly encountered an SMS spoofing scam. Fraudsters send carefully forged SMS messages that look identical to bKash or Nagad alerts, attempting to trick merchants into releasing goods or crypto.

1. Anatomy of the "+16247" Spoofing Attack

The official sender masking for Nagad is 16247, and for bKash it is bKash. However, international VoIP providers and online SMS gateways allow malicious actors to set custom sender caller IDs. To bypass telecom filters, scammers register international numbers such as +16247, 0016247, or +88016247.

When an unvetted system or busy human sees a message reading:

You have received Tk 5,000.00 from 017XXXXXXXX. Ref: P2P. Fee Tk 0.00. Balance Tk 48,500.00. TrxID 9K38FA28 at 03/09/2026 21:00

they might immediately fulfill the order without checking their live balance.

2. How FuturePay Eliminates Spoofing

FuturePay's Android Gateway app implements hard-coded, telecom-level security verification:

• Strict Whitelist Check: Rejects any message where the sender address starts with + or 00.
• Exact Sender String Matching: Requires exact equality with official telco shortcodes (e.g. bKash, 16247, 16216).
• TrxID Database Uniqueness: Enforces that a given TrxID can never be utilized twice, blocking replay attacks with old SMS screenshots.