Researchers say multiple telcos are deploying RCS in ways that expose users to text and call interception, spoofed phone calls, and location data leaks
A standard used by phone carriers around the world can leave users open to all sorts of attacks, like text message and call interception …
Context & Ripple Effects
This finding lands in a well-documented arc: researchers had already cataloged ten LTE attacks enabling text eavesdropping and emergency-alert spoofing, then showed [[a:938916|~$200 of equipment suffices for targeted denial-of-service and location tracking on 4G and 5G]]. By mid-2019 the picture widened again when hackers were found stealing call records at scale from more than ten providers worldwide for targeted surveillance (the call-records theft campaign).
The new twist is that RCS — the carrier-deployed successor to SMS meant to modernize messaging — repeats the same failure pattern inside the operators' own rollout choices rather than in the underlying radio standard. That matters because it shifts blame from legacy hardware to how carriers deploy a current-generation service.
First-order effects
- Subscribers on carriers with vulnerable RCS deployments are exposed right now to intercepted texts and calls, spoofed caller identity, and leaked location data — protections they assumed come with the network do not.
- Carriers running these deployments face immediate remediation work on their own configurations, not a vendor patch: the flaw follows from deployment choices, making each operator individually responsible for closing its exposure.
Second-order effects
- Security researchers will treat RCS interconnects like the roaming-signaling flaws they already used to geolocate devices through international roaming infrastructure, extending scrutiny from radio layers into carrier messaging backends.
- Pressure builds on the same support-channel weaknesses later documented at AT&T, T-Mobile, Tracfone, US Mobile, and Verizon for SIM-swapping risk (the SIM-swap exposure findings) — together pointing auditors and regulators at carrier operational practices, not just protocols.
Third-order effects
- If the pattern holds, the carrier-trust model erodes structurally: users and enterprises migrate sensitive messaging toward end-to-end encrypted services precisely because operator-run channels keep proving interceptable.
- Regulators get a growing evidentiary base that carrier-side deployment negligence — not only protocol age — creates consumer harm, opening the door to mandated security audits of network rollouts.
The trend: Independent researchers are systematically exposing that carrier-controlled network infrastructure — from LTE to roaming signaling to RCS messaging — is deployed less securely than its specifications assume, outpacing operator fixes.