Recently smartphones provide a variety of Internet-based personalized services and applications with the benefit of the advanced wireless technologies such as Wi-Fi and 3G, and the advance of computation power as much as a personal computer. They necessarily contain lots of personal information such as credit cards, contacts, personal identities for the intelligent service provisioning. However, the intensive belonging of valuable private data on the smartphone will be hacking target by the potential attackers. For example. the mobile malware called Terdial which makes unintentional international calls has been introduced. In this paper, we analyze vulnerabilities of SMS management on Windows CE kernel. Using these, we develop a potential mal ware that incurs financial theft by intercepting the SMS authorization code for mobile payments. Also, we propose the countermeasure against such malicious attacks at the different viewpoints of application and OS layers with thorough analysis of our experimental results.