Lost in translation: when your bank texts you — but it isn’t your bank

### Executive summary This report reviews the “Lost in Translation” research showing how legacy email-to-SMS gateways and inconsistent messaging-client parsing can be abused to inject spoofed messages into trusted mobile conversation threads, greatly increasing the effectiveness of phishing; carriers largely mitigated the issue before public disclosure, and the report recommends treating SMS as low-trust, adopting phishing-resistant MFA, enforcing device posture controls, and integrating device trust into access decisions.