News

• Surfshark unveils scam text protection against SMS-based phishing
• The AI-driven tool screens texts in real time on iOS and Android
• The feature is available for Surfshark One and Surfshark One+ subscribers

If your phone is constantly buzzing with suspicious package delivery updates or urgent bank alerts, you aren't alone. Americans received an average of 19.2 billion spam texts per month in late 2023, a near-threefold increase since 2021. To tackle this growing epidemic, one of the best VPN providers on the market, Surfshark, has launched a dedicated real-time tool to fight back against SMS fraud.

Following the company's recent decision to shift its focus to fighting scams, the new scam text protection feature is designed to safeguard mobile users from "smishing" (SMS phishing). Using AI-driven technology, the tool screens incoming messages to detect dangerous URLs, suspicious sender numbers, and fraudulent content before you can accidentally click on them.

With SMS scams now accounting for 35% of all phishing attempts globally, blocking these threats at the source is becoming essential for mobile security.

“Recently, we have introduced a scam protection hub, a unified space to make it easier for users to defend against modern, human-centric cyberthreats like scams, phishing, or identity fraud," explained Dominykas Simkus, Senior Product Manager at Surfshark. "Scam text protection is our newest feature to be introduced to face these online threats and help users fight increasingly sophisticated SMS-based scams.”

Surfshark – the best cheap VPN
Surfshark is a fast, easy-to-use VPN that seriously beats the competition when it comes to subscription pricing. Its two-year Starter plan works out at $2.49 a month (plus tax), but we think Surfshark One is the best value plan as it adds an antivirus, data breach monitor, alternative ID, and now new anti-scam tools. All of this starting from the equivalent of just $2.79 a month. View Deal

The new feature handles threats differently depending on your mobile operating system.

For iPhone users, it works entirely in the background. Once a scam signature or suspicious pattern is detected, the iOS native Messages app automatically moves the fraudulent text to the Spam folder. You won't even receive a notification, effectively removing the temptation to open the message.

On Android, the approach is more transparent. Users receive a warning notification from Surfshark alerting them to a detected scam. Clicking the notification opens the message in a controlled, risk-free environment within the Surfshark app, allowing you to examine the contents safely without accidentally triggering a malicious link.

Users also gain access to an in-app dashboard detailing their blocked suspicious messages. In a unique addition for US citizens, the dashboard even calculates an estimate of how much money they likely saved by avoiding each fraudulent text.

For those worried about privacy, Surfshark explicitly states that the feature does not retain your messages, monitor your phone generally, or use any private data to train its AI models.

"While traditional cybersecurity focuses on malware and hacking, modern scams increasingly target human behavior through social engineering techniques that exploit trust, urgency, and exposed personal data," said Simkus, explaining that SMS-based sophisticated scams are very difficult to spot.

"Our tool is built to spot mistakes or suspicious patterns in order to avoid any interaction with bad actors," Simkus added.

The Scam text protection feature is rolling out now for users subscribed to the premium Surfshark One and Surfshark One+ plans. To get immediate access, Surfshark recommends manually updating your app via the Apple App Store or Google Play Store.

With all the buzz around nation-state threats, it’s easy for organizations to focus on threats outside the business – and forget about risks that can spiral outwards from within.

Whilst GenAI tools have introduced undeniable efficiencies for employees, these platforms have also introduced a new class of risk: two in three UK organizations admit they can’t track whether employees are sharing data via approved tools.

Most of the time, employees aren’t sharing sensitive data because they have malicious intentions. They are uploading sensitive information – like contracts, client proposals or supplier agreements to models like ChatGPT and Claude to save time on routine tasks.

Almost all (93%) of CEOs across the globe have adopted generative AI to some extent in the past 12 months (PwC). What’s concerning is that much of this activity is happening without any oversight, in the browser – meaning organizations are failing to track the flow of company information, including when and where it’s uploaded.

This is spiraling into serious risk for businesses.

First, because employees may inadvertently share credentials or other access details with public LLMs, which could result in unauthorized access if the model is compromised.

Second, uploading personal data to LLMs can trigger compliance breaches with laws like GDPR and the Data Use and Access Act – resulting in costly fines as well as reputational damage.

To take control of this issue, leaders will need to implement tools and technologies that provide visibility and control over usage at both the browser and the application levels.

Employees don’t need more mandatory cybersecurity training – the problem is incentive. Many company-owned gated LLMs are still in the pilot stage, falling short of the speed and precision offered by public alternatives.

While the majority of employees understand the risks, 35% of UK businesses admit data sharing through external tools takes place – indicating many would rather ‘throw caution to the wind’ than waste valuable time using slower tools.

But the risks of this behavior – particularly in highly regulated sectors like financial services, could mean unsanctioned LLMs become 'hidden icebergs’ in an organization. Concealed, but capable of causing catastrophic damage upon impact – like inadvertently exposing customer transaction histories or credit scores.

Part of curbing Shadow AI use in the enterprise therefore starts with designing approved AI tools that integrate easily with existing platforms (for example, Microsoft 365 and Google Workspace). These tools should be continuously improved based on user feedback, ideally avoiding excessive restrictions that make the tool frustrating to use.

But the fact is, nearly two-thirds of organizations are currently stuck in the pilot stage when it comes to their AI initiatives and haven’t started to scale across the enterprise (McKinsey). So, what can organizations do today to gain control of the Shadow AI problem?

You can’t control what you can’t see, which is why organizations need a real-time view of who, or what, is accessing what data, from which devices, and where it’s being shared.

Next-gen identity security platforms can help organizations to gain an immediate understanding of how employees interact with consumer AI tools like ChatGPT, Claude, and Gemini, tracking interaction frequency and monitoring document uploads.

Once high-risk behavior is identified, organizations can then automate corrective actions, redirect users to secure AI alternatives, or prompt users to justify their business use case before proceeding.

Visibility will become even more important with the emergence of ‘nested’ agents. In this scenario, employees might believe they’re only interacting with a single AI agent, but that chatbot may delegate tasks to multiple underlying agents. The organization has no visibility into how many downstream agents or services its information is being shared with.

An identity security tool makes these identities ‘discoverable’ via a real-time ‘agent ledger’. This ledger acts as a complete, unchangeable trace of all agent activities and interactions. It also applies controls to each agent in the database.

Only the absolute minimum privilege required for a task is granted, at the exact moment it is needed, and for the shortest possible duration. In this way, agent permissions don’t automatically ‘cascade’. If an agent wants to connect with another agent, it must be verified by the system first.

Shadow AI is more than a tooling problem: it’s an identity problem. Organizations can close the ‘visibility gap’ by using tools that track interaction frequency, block sensitive document uploads, and prompt employees as well as AI agents to justify their business case before they use unsanctioned tools.

Once organizations know which tools are being used, what data they're accessing, and where that information goes, they can apply effective guardrails to secure behaviors – both human and non-human. A simple inventory of AI agents is not enough; now, organizations need to move beyond flat inventories and develop an understanding of the context and relationships that surround every agent.

In essence, identity security platforms become adaptive – moving from static to dynamic, real-time approaches to access. This is helping organizations to operationalize zero trust by ensuring that no identity, human or non-human, is trusted by default.

In the era of AI agents, securing identity has become a prerequisite for innovation.

We've featured the best AI tool.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit