Curiosity got the better of me and I clicked on one and it shows the same iOS page about a shared location as a valid one would. It seems therefore to be either an actual location share or a reasonably sophisticated other method.

I’m running the iOS 18 beta, and wonder if this is something to do with the new addition of RCS into messaging. I don’t know anything about the way this works but I wondered whether if a non-iMessage SMS system sent a correctly formatted location string to an iMessage recipient it would be assumed to have originated from iMessage and formatted into a proper looking location page. Just a thought.

The message is marked RCS at the top but with the reply by SMS thing at the bottom as you would see on non-iMessage replies.

The only other thing of note might be that all four numbers have been the kind that are fairly easy to remember, what we might have called gold or silver numbers here in the UK back when memorable numbers mattered :) but that might just be an unrelated coincidence.

It seems to me that it must be a scam of some sort, so my main question is what is the attack vector? (and I suppose follow up, has any harm already come of me clicking on the location..)

I have read receipts off at least.

I have put a screenshot here in case anyone wants to look at it although there isn’t much to it (except the RCS label I already mentioned) and I have cropped the number off.

[1] https://imgur.com/a/clNW5oI