BillBait: How SMS autofill can sign you up for a paid subscription

Most of us are familiar with SMS verification codes. You want to sign in to an account from a new device, reset a forgotten password, or confirm your number when signing up for a service. A code arrives by text, and you enter it to continue. It’s a routine part of digital life most people don’t think twice about.

Often, you don’t even have to retype the code yourself: your browser or phone fills it in for you automatically. This helps reduce friction from a potentially annoying step in a sign-in or sign-up process.

Unfortunately, some merchants are exploiting that same convenient feature to rush people into paid subscriptions. Autofill makes it easier to overlook the cost and frequency of billing.

Threat Researchers at Gen, the company behind Norton, investigated this practice and found  examples of BillBait sign-ups in Poland, Switzerland, Denmark, and Canada. Victims report encountering this practice — which can feel like a scam — in ads for streaming services, parking payment QR codes, and other places. Read on for an explanation of how BillBait works, or read the technical analysis of the BillBait scheme on the Gen Blog.

What is BillBait?

BillBait is our term for misleading subscription sign-ups that use SMS autofill to get people to enter a payment authorization code — often disguised as a phone number verification step — without opening the text message containing the subscription terms.

These services then charge you through your mobile operator or carrier. This payment method, known as carrier billing, lets you pay through your phone account instead of providing card details. No separate bank or card authorization is needed to start the charges, meaning victims might not notice right away they’re being charged.

While billing details may appear on the service’s landing page and in the text containing the “verification code,” small print or an on-screen keyboard can obscure them on the page, while autofill lets users skip opening the message altogether.

BillBait turns what's meant to be a convenient feature designed to reduce sign-up friction into a misleading subscription journey that can feel like a scam.

How a BillBait subscription works

In the sign-ups examined, users are asked to “verify their phone number” to access a service. They enter their number and receive a code by text. The text message explains that the code authorizes a subscription, including its price and billing frequency. But, because the code is entered into the website automatically, people never need to open the actual text message and read the contents. They’re then on the hook for a subscription added to their cellphone bill.

1. You’re asked to “verify your number” to get access to a service

A website asks for your phone number so you can access content or continue. The instructions make the request seem like a routine verification check. They may state that you’re agreeing to a subscription, but the details are often concealed in small font.

In the wild, our Threat Researchers found examples of this entry door in ads for streaming services and language learning apps. On Reddit, victims have also drawn attention to this scheme being used in potentially malicious QR codes on EV charging stations and parking meters.

2. You get an SMS code that autofills on the website

A text arrives with a code and the subscription’s price and billing frequency. Autofill lets you enter the code without opening the message and reading those terms.

In one example, the autofill suggestion displayed the code and an amount of 14.99 Polish złoty (almost $4 USD at the time of writing), but omitted that the charge would repeat every week.

3. You complete the sign-up, potentially unaware you’re confirming a paid subscription

You submit the code and complete any remaining steps, such as accepting terms or pressing a payment button. This authorizes a subscription charged to your mobile account. Because the charge is added to your phone bill rather than being taken out of your bank account directly, you might not notice you’re paying for a new subscription.

4. You never open the text explaining the recurring charges.

In the BillBait scheme, subscription details are designed to be ignored.

The SMS you receive with the “verification code” does explain the service, price, and billing frequency. But autofill has let you complete the process without ever opening it, leaving that fuller explanation unread.

Typically, payment information is available somewhere, but it often competes with other prominent instructions and the convenience of autofill. Smaller text or an on-screen keyboard can make webpage disclosures easier to overlook. Landing pages might hide the payment details in small font.

BillBait examples

Below are several examples of the BillBait scheme that our Threat Researchers found in the wild. The first shows a sign-up page for a language-learning app. The page does explain there’s a monthly recurring charge, but this is in small font, and the sign-up instructions don’t clearly explain that providing a phone number will trigger a subscription.

Another example, found in Poland, shows an ad for a streaming site that tells users to verify their phone number to get full access. Subscription details appear in tiny font. There is no indication that the phone number verification process triggers a subscription. Below, we’ve provided the original Polish ad alongside a translated version we created for English-speaking audiences.

BillBait across platforms

The researchers’ examples show an important difference in how payment information appears across platforms.

On the iPhone tested, the autofill suggestion showed an amount, but did not note the weekly billing frequency. The person needed to read the SMS or other information on the page to understand that the charge would repeat.

In the Android example, Chrome asked permission to read the SMS and enter the code. Its prompt displayed a message that included the weekly charge, so the subscription information was available within the prompt itself. But, crucially, the request was formulated as a privacy or security question, asking if Chrome should be allowed to read the message and input the code in the browser — potentially making it less likely for the user to read the prompt.

Both let someone enter a code without opening their messages app. Chrome’s prompt included the recurring charge, while the tested iPhone suggestion omitted that detail. These findings describe the captured examples; they don’t establish how every device or browser displays payment codes.

Gen’s researchers recommend that Apple and Google work with carriers and payment providers on clearer payment confirmations. The service name, amount, and billing frequency should be visible alongside the action used to confirm the purchase.

How to avoid falling for BillBait subscriptions

The best way to help avoid falling for BillBait is to carefully review what you’re signing up for whenever you’re asked to enter an SMS code.

• Open the full text before you enter any code: Ignore the autofill chip for a second and read the message. Check that the service name matches what you intended to buy and that the amount and billing frequency are what you expect.
• Stop if the message describes a subscription you weren’t looking for: That holds even when the website presents the code as a routine check.
• Remember that ads telling you to “verify your phone” or “Continue” are still ads: If you didn’t set out to sign up for a service, close the page and go back to what you were doing.
• Be cautious with QR codes for parking and EV charging: Use the operator’s official app where one exists, and be suspicious if a QR code request appears where you expected a card payment, especially in a public place.
• Ask your carrier to block third-party charges: Many carriers can block premium or third-party billing on your account if you ask. Ask what controls apply to third-party billing specifically, since the options vary by carrier and country.
• Read your phone bill every month: Look for charges from names you don’t recognize, especially small recurring ones.
• Get a money management app: Apps like Norton Money help you track spending across connected financial accounts, making it easier to notice unexpected increases in your bills.

What to do if you’ve been charged in a BillBait situation

Contact your carrier through its official app, website, or customer service number. Ask who is collecting the payment, how to cancel the subscription, and how to dispute the charge.

Keep the text messages and any screenshots of the ad or payment page. Verify cancellation instructions before following them: some services use a STOP message, but you shouldn’t assume that applies to every subscription.

Blocking the sender or marking the texts as spam does not cancel the subscription. Confirm that the recurring billing has stopped, and check subsequent bills for further charges.

FAQs

Does SMS autofill charge you money?

SMS autofill enters a code; it doesn’t itself collect payment. However, a code can authorize a paid subscription. In the BillBait examples, autofill lets someone enter that code without opening the SMS explaining the charge. The captured iPhone payment page also included a terms checkbox and an “I order and pay” button.

Is carrier billing legitimate?

Carrier billing is a legitimate payment method that puts a purchase on your mobile account instead of a card. BillBait is about misleading sign-ups using that method. Before confirming a payment code, check which service is charging you and whether the payment repeats.

Is BillBait the same as a fake text message?

Not necessarily. The messages examined contained subscription information and payment authorization codes. The misleading element was the sign-up journey: someone could believe they were verifying their phone number while they were actually authorizing a subscription. Reading the full SMS helps reveal that mismatch.

Will deleting or blocking the texts stop the charges?

No. Managing the messages doesn’t cancel the subscription. Contact your carrier to identify the service, confirm how to cancel, and ask how to dispute an unfamiliar charge.

Is BillBait a scam?

BillBait can feel like a scam, but it’s really an example of dark marketing: tactics that use misleading wording or design to steer people into purchases or subscriptions they didn’t intend to sign up for.