MMS scam??

[djmac]

I recieved a message yesterday on my telstra (android) mobile phone, purportedly from one of my contacts. It read:

• You have a new MMS Picture or Video Message. To view your message, go to telstra.com/viewmms & enter User ID:XXXXXXXXXX and Password:XXXXXX within 14 days

The username id was my phone number and the password was random. I visit the websited from my phone (which I might add entirely defeats the purpose of an MMS...) and the there was a (legitimate) message and picture from said contact.. 

I went back to the website today on a pc to download the image - and am consequently concerned about the website... the legitimate looking telstra.com/viewmms redirected to this:

• https://mymessages-1.mymessages.telstra.com/mmbox/otp.html

Which is not as a legitmate looking address (and in the PC web-browser, the website does not very Telstra-y). So I am a bit concerned this is some kind of scam or something...

My questions are:

• Has anyone else had this experience or used "telstra.com/viewmms"?
• Importantly, is this legitimate, or some kind of scam website?
• If so, what have I exposed myself to, and what should I do about it?
• If not,  why do we have to visit a website to view an MMS? Very counter-productive (and annoying!). 

Thanks in advance.

[JCKH · Accepted solution]

Hey djmac,

You will generally get this message if there has been some difficulty in delivering the MMS via standard methods straight to the phone. This can be a settings or account related.
However the website is a legitimate link which will enable you to view the MMS which has been sent to your mobile number.

In terms of fixing this so that MMS come straight to your phone, i would recommend calling faults on 125111 (say 'faults') and getting them to check your account and handset settings. Alternatively if you've got a local Telstra shop with a Tech Bar they will be able to fix up the issue there for you too

[KrayzeeKev]

---

I went back to the website today on a pc to download the image - and am consequently concerned about the website... the legitimate looking telstra.com/viewmms redirected to this:

• https://mymessages-1.mymessages.telstra.com/mmbox/otp.html

Which is not as a legitmate looking address (and in the PC web-browser, the website does not very Telstra-y). So I am a bit concerned this is some kind of scam or something...

---

It looks very Telstra to me - but not current Telstra. Which pretty much makes sense given when it was built.

It is legit and it's how MMS messages are delivered to phones which can't (for whatever reason), receive them. As others have said, log a fault to get it fixed.

One way to verify that the site is legit, given that it is an HTTPS site, is to view the certificate information which shows that is has been signed by the Telstra CA which is in turn signed by RSA who are a top-level trusted certification authority.

[djmac]

Thanks for your fast reply... 

(I think the error "This server's security certificate is not yet valid!" that poped in red may have contributed to my paranoia).

[KrayzeeKev]

---

@djmac wrote:

Thanks for your fast reply... 

(I think the error "This server's security certificate is not yet valid!" that poped in red may have contributed to my paranoia).

---

Then the date on your computer may be wrong. The cert on that site is valid from Sep 2011 to 2013. The intermediate above that is 2011 to 2016. The one above that is 2009 to 2017 and the root is 2001 to 2026. 

Sounds like the date on your phone/machine is set earlier than (at least) one of those start dates.