I need to learn more about this. A family member got a fraudulent text from a bank... It was actually the right short code for the bank but the content of the message was just a little off-seeming. I can't remember if it was poor grammar or a spelling error or why we were suspicious of it. I've always wondered how that was possible. I know short codes can technically be spoofed but I've always read that it's difficult and unlikely.

What a fascinating (but horrible) story this is. Thanks for sharing!

cell service is notoriously insecure.

i've always said this of 2fa by sms, just an excuse by providers to wrestle your phone number out of you.

Been around for a while, typically Stingrays - basically just fake cell towers