Vivo, Claro, TIM Phishing: How to Spot Fake Carrier Messages in Brazil

Brazil's three major mobile carriers — Vivo, Claro, and TIM — serve over 200 million subscribers combined. That massive customer base makes them prime targets for phishing attacks. Scammers impersonate these carriers through SMS, email, and even phone calls to steal personal data, install malware, or charge victims for services they never requested.

Here is how to recognize and avoid carrier phishing in Brazil.

Common Carrier Phishing Techniques

1. Fake SMS About Overdue Bills

The most frequent attack. You receive an SMS claiming your bill is overdue and your line will be suspended:

• "Claro: Sua fatura de R$189,90 esta vencida. Evite bloqueio: [malicious link]"
• "TIM: Ultimo aviso! Pagamento pendente. Regularize: [link]"
• "Vivo: Sua linha sera suspensa em 24h. Pague agora: [link]"

The link leads to a fake payment page that steals your credit card information or generates a fraudulent boleto.

2. Fake Promotion and Loyalty Offers

Messages promise incredible deals — free data, plan upgrades, or loyalty rewards:

• "Parabens! Voce ganhou 50GB gratis da TIM. Ative: [link]"
• "Claro Clube: Resgate seu bonus de R$100. Acesse: [link]"

The link either installs malware, harvests login credentials, or subscribes you to premium SMS services.

3. Fake Billing Emails

Professional-looking emails with the carrier's logo and formatting arrive with an attached "fatura" (bill) or a link to view your invoice online. The attachment contains malware, or the link leads to a credential-harvesting page.

4. Unauthorized Plan Changes

Scammers who obtain your account information (from data breaches or social engineering) call the carrier pretending to be you and change your plan to a more expensive one, add premium services, or request a new SIM card (for SIM swap attacks).

5. Fake Customer Support Numbers

When you search for "Vivo atendimento" or "Claro numero de telefone" online, sponsored search results may show fake phone numbers. Calling these connects you to scammers who impersonate support agents and extract your personal information.

How to Identify Fake Carrier Messages

Indicator	Legitimate	Fake
Sender	Official short code (e.g., Vivo: 1058)	Random phone number or generic short code
URL	vivo.com.br, claro.com.br, tim.com.br	Misspelled domains, URL shorteners
Tone	Professional, no urgency	"URGENT!", "Last chance!", threatening
Request	View in app or official site	Click link to pay, enter credentials
Personalization	Uses your name, last 4 of CPF	Generic "Dear customer"
Timing	Aligns with your billing cycle	Random, often late at night

Official Carrier Contact Information

Always use these official channels — never trust numbers from search results or messages:

Carrier	Customer Service	Official App	Website
Vivo	1058	Meu Vivo	vivo.com.br
Claro	1052	Meu Claro	claro.com.br
TIM	*144	Meu TIM	tim.com.br

How to Verify Legitimate Communications

Step 1: Do Not Click Links

If you receive a message about a bill, promotion, or account issue, do not click any links. Open your carrier's official app instead.

Step 2: Check in the Official App

All three carriers have apps where you can:

• View your current bill and payment status
• Check active promotions
• Review plan details and any recent changes
• Contact support through official chat

Step 3: Call the Official Number

If something seems wrong, call your carrier's official customer service number (listed above). Explain what you received and ask them to verify.

Step 4: Report the Phishing

• Forward suspicious SMS to 7726 (SPAM) — works for all carriers
• Report phishing emails to your email provider
• Report to Anatel (Brazil's telecom regulator) at anatel.gov.br

Protecting Your Carrier Account

Set Up Account Security

1. Create a strong password for your carrier's online portal and app
2. Enable two-factor authentication where available
3. Set up a verbal password (senha de atendimento) — required for phone support changes
4. Register your email in the official app for billing notifications
5. Review your plan regularly for unauthorized add-ons or changes

Guard Against SIM Swap

SIM swap fraud starts with your carrier account. Protect yourself:

1. Contact your carrier and request a SIM lock — requiring in-person verification with ID for any SIM changes
2. Use an eSIM if your phone supports it — eSIMs cannot be physically cloned
3. Set a PIN on your SIM card through your phone's security settings
4. Monitor signal loss — If your phone suddenly loses service, someone may have activated a new SIM

Watch for Unauthorized Charges

Premium SMS services (SVA — Servico de Valor Adicionado) are a common scam revenue source:

• Check your bill for charges from services you did not subscribe to
• Contact your carrier to block all premium SMS services
• Report unauthorized charges to Procon

Sharing Account Information Safely

When you need to share carrier account details with a family member managing your plan, or with IT support at work, do not send credentials through plain SMS or WhatsApp. Use LOCK.PUB to create a password-protected link that expires after use. This prevents your carrier login from sitting permanently in a chat thread where it could be compromised.

What to Do If You Fall Victim

1. Change your carrier account password immediately through the official app
2. Check your plan for unauthorized changes or add-ons
3. Dispute unauthorized charges with your carrier's customer service
4. Report to Anatel if your carrier does not resolve the issue
5. Scan your device for malware if you clicked a link
6. Change passwords for any accounts linked to your phone number (especially banking and email)
7. File a B.O. (police report) if financial losses occurred

Conclusion

Carrier phishing exploits the fact that everyone has a mobile plan and everyone receives legitimate messages from their provider. The key defense is simple: never click links in carrier-related messages. Always verify through the official app or by calling the official customer service number.

For sharing carrier account details or any sensitive login information securely, visit LOCK.PUB to create free password-protected, expiring links.