6

I have a client who claims that some text messages "appeared" on her phone that she did not send. I think she may be telling the truth because it seems entirely too coincidental that these messages were sent just as my client filed for divorce. I am also suspicious because I am told that her husband gave the text messages to his lawyer but he has not been around her (or her phone) for several months so he wouldn't have access to her phone. I am also suspicious because there are only a limited number of texts, whereas it is my experience that more than a few texts would be exchanged between persons that were engaged in a romantic relationship.

Is it possible to have a text message that my client didn't send appear on her smart phone making it look as if she did send the text? If so, am I correct in assuming that the person who is responsible for sending the texts would have access to those text messages?

It may be important to note that this did not occur on American soil. My client was in Lebanon at the time these texts appeared on her phone.

Any help would be greatly appreciated.

Lawyerman
  • 61
  • 1
  • 1
  • 3
  • 2
    Was the google play account ever controlled by the husband? Were there unusual logins on the account? With access to the play store account, you can remotely install apps onto the phone. – user10008 Sep 17 '14 at 23:22

4 Answers4

7

It is possible, even without a hacker's technical skills but with a bit of planning ahead.

Multiple apps allow you to remotely control your own phone, which implies that you must install them yourself to your phone. Let's call your client Alice and her husband Bob. Let's assume Alice owns an Android.

It's fair to assume that Bob knows the PIN/gesture to Alice's smartphone: they have lived together after all. I certainly know my girlfriend's gesture from mere observations. Bob used to have access to the device and could have installed an app and left it dormant on the phone for long.

Then, he could have used that app to remotely send texts from the device. Those apps quite literally ask for the permission to send texts, so the texts do are sent from the device. I just tested sending a text from my computer with AirDroid, and I do see my sent text on the phone as well. I am also able to uninstall AirDroid from the computer to erase my traces.

The obvious warning...

This goes beyond opportunistic nuisance, as it requires a bit of planning on behalf of Bob. If Alice and Bob have been away from one another for months then you must take the time to consider how likely you think such a scenario is, but I'd assume you're much more aware of this than I am.

What to do?

You'd need to look if there is any information in the Google Play account of Alice or on her device on apps that were previously installed -- I'm actually unsure of this. As you are a lawyer you may also be able to contact Google and ask for a history of the device and installed apps, which is something they might be expected to keep. As a last resort, ISPs and websites have to keep a history of connections from any IP address so you could try to trace back whether any connections to such remote texting apps' websites were made from Alice or Bob's devices.

Steve Dodier-Lazaro
  • 6,848
  • 30
  • 45
  • 1
    +1. A forensics analysis of the phone could also reveal activities as described in your answer. – WoJ Apr 25 '15 at 21:04
1

In theory yes, there are a number of scenarios where this could potentially happen, for example installing malware on the phone either in advance or through some exploit, or even just having an accomplice do it.

In practice though unless the husband has some pretty advanced technical chops (or really good connections, think military or secret service), then the texts were almost certainly sent from the phone. If you hear hoof-beats think horses, not zebras. I would imagine either your client is lying, or possibly was inebriated at the time. The other plausible scenario is the texts were sent by an accomplice to the husband.

jhoyla
  • 439
  • 2
  • 6
0

This is possible, by three means (this is not exhaustive, there may be others):

  • "Inside job": the phone was compromised and a tool to remotely control it was installed on it and used to remotely send messages, without requiring nor notifying the user. This requires either a physical access to the phone or knowing the person's gmail account credentials (username + password and possibly phone text access if 2-steps authentication is enabled). It has always been possible to do so with Android (see AirDroid app), but it's becoming more and more difficult to remotely delete messages or bypass the Android default text manager (before Android KitKat, apps could delete messages without requiring user's consent, now it's impossible, at least theoretically - I'm sure a pro hacker can do something about that, but this requires a very high level of expertise, you cannot find such an exploit on the internet currently). This is the most probably scenario (if your client is not lying of course) if there are multiple messages, particularly over several days.

  • Buggy network routing: it can happen sometimes that one message gets lost in the network and that someone gets a message he shouldn't. This is very rare (I already experienced it myself), because there are error correcting codes that try hard to prevent any error in the network and in the messages, but this is not impossible, just highly unlikely. Since this is very unlikely to happen, if it does happen, only one or two messages will be wrongly misrouted to a person (not a string of messages and not over several days, it can only be punctual). Also, since this is because of a network error, the content will probably be totally unrelated to the implied persons (ie, content non pertinent, hour and time totally unrelated to the person's activity like during night, etc). There is a discussion about such an instance here.

  • SMS Spoofing: Just like the buggy network routing, but done intentionally: any sender can manipulate the sending address of a SMS. This is done legitimately by some companies to replace the sender personal number by the one of the company or by alphanumeric text. Operators can usually detect when SMS are spoofed, so you may try to give a call to your client's operator to check if this was the case or not.

However, you didn't precise what kind of phone your client is using, nor the way the messages were sent (SMS, iMessage, WhatsApp, etc.) so the modality can change (but these technics generally remain possible, although they may be more difficult with those other networks). Also, remember that SMS are generally always supported in all networks as an alternative to send and receive text messages, and I'm not sure these apps will tell you what kind of network was used for each message. For example, iMessage allows you to send SMS instead, and it streamlines all messages in one same interface.

gaborous
  • 121
  • 3
-1

I had this happen this morning at 5am when I was not lying, inebriated or even awake. I was alone in a hotel room and had my laptop, iPad and iPhone with me. A string of messages 5 messages were sent to the weather alerting sms service at my daughter's school.

The only possibility that I can come up with is related to the fact that my phone will occasionally open Siri when sitting on a counter or bedside table.

I did get a text from the school, then the messages were sent as if in response. If speech to text was turned on spontaneously, it could have heard my tv (or me talking in my sleep) and sent that back to the school.

Not an answer, but maybe the speech to text is a clue. Maybe shut those features down and see if the problem goes away.

george
  • 1
  • 1