Systems, methods, and software can be used to prevent messaging attacks. In some aspects, a scanning short message is sent to a UICC associated with a mobile device. A response short message is received in response to the scanning short message. The UICC is determined to be at risk to attacks based on the response short message. In response to determining that the UICC is at risk to attacks, a notification is generated. In some cases, the notification is sent to a DMS. Alternatively or in combination, the notification is displayed on the mobile device. In response to determining that the UICC is at risk to attacks, a firewall application is installed on the mobile device. The firewall application is configured to process an incoming short message addressed to the UICC.