Just like the internet never stops, cybercriminals are always active. These scammers are constantly trying to take advantage of people, businesses, and data to make money. One of their most harmful tricks is called smishing.
In the first six months of 2021, these attacks increased by over 700%, costing victims more than $10 billion. These victims included individuals and businesses, with employees falling for these scams through company software and communication channels. The danger kept growing in 2022, with three out of four IT professionals worldwide reporting that their organizations faced smishing attacks that year.
In this article, we’ll explain what smishing is, how it works, give some examples, and show you how to protect yourself and your business from these scammers.
What is Smishing?
Smishing is a combination of “SMS” (texting) and “phishing.” It’s a type of scam where cybercriminals use text messages instead of emails to trick people. Unlike technical hacks, it relies mostly on exploiting human trust.
When cybercriminals “phish,” they send fake emails to get you to click on harmful links. Smishing works the same way but through text messages. The goal of these scams is to steal your personal information, which can then be used to commit fraud or other cybercrimes, like stealing money from you or your company.
Cybercriminals typically use two methods to steal data through smishing:
- Malware: The link in the smishing text might trick you into downloading malware, a type of harmful software. This malware can look like a legitimate app, but it’s designed to steal your confidential information.
- Malicious Websites: The link might lead to a fake website that asks for your personal information. These sites are made to look like real ones, making it easier to trick you into giving away sensitive data.
These messages frequently pose as coming from your bank and request financial or personal information, such as your ATM or account number. Giving this information is like handing thieves the keys to your bank account.
As more people use their personal smartphones for work (a trend called BYOD, or “bring your own device”), this attack is becoming a threat to businesses as well. It’s now the leading form of malicious text message.
Cybercrime targeting mobile devices is increasing along with mobile device usage. Texting is one of the most common uses for smartphones, making smishing a particularly sneaky threat.
Let’s take a closer look at how its attacks work.
How Does Smishing Work?
Smishing is a scam where cybercriminals send you text messages that make you feel comfortable sharing personal information. Often, these messages are actually emails sent to your phone, so the attacker doesn’t need your phone number. These texts may include a link to a website that looks real, but when you enter your information, it gets stolen by the scammer and either used by them or sold to others.
Smishing attacks usually involve a few steps:
- Creating Urgency: The message makes you feel like you need to act quickly. It might say you need to respond for legal reasons, to make money, or to save money from being stolen.
- Fake Websites: The message includes a link to a site that looks just like a real one. For example, if it’s pretending to be from the government, the site will have official logos. If it’s pretending to be from a bank, the site will use the same fonts, logos, and colours as the real bank’s website.
- Collecting Information: The fake site asks for your personal information, such as your account name and password. Once you enter and submit this information, the scam is successful.
Sometimes, it can work with fewer steps. For example, the initial text might contain a link that, when clicked, downloads malware to your phone. It can then steal your sensitive information.
What Are the Types of Smishing Attacks?
Smishing is dangerous because there are many ways scammers can trick you. Let’s see some common types of smishing attacks:
- Prize and Package Scams: These scams play on your excitement about winning something or receiving a package. Scammers pretend to be from companies like Amazon, Costco, FedEx, or UPS. They ask for your address, credit card info, or a shipping fee and direct you to a fake link to steal your information.
- Banking and Financial Scams: These scams use your financial concerns to get a quick reaction. Scammers pretend to be from a bank or the IRS, saying there’s a problem with your account, a refund, an overdue payment, or an investigation. They aim to steal your login details, Social Security number, credit card number, or other banking info.
- Investment Scams: A popular one is the “pig butchering” scheme, where scammers convince you to invest in cryptocurrency with promises of high returns. They ask you to create accounts on fake trading platforms, sometimes showing initial returns to seem legitimate. Then, they gain access to your account and steal all your money.
- Account Verification and Password Scams: These scams trick you into thinking your account is compromised, leading you to a fake login portal. Scammers might also ask for answers to security questions or multifactor authentication (MFA) codes, allowing them to bypass security measures.
- Opportunistic and Topical Scams: These scams exploit current events or trends to trick you. Examples include fake COVID-19 vaccine appointments, bogus charities for wars or natural disasters, and scams related to student loans, taxes, stimulus payments, or job opportunities.
Each type of attack uses different tactics, but the goal is always to steal your personal information or money. Be cautious and double-check any messages asking for your details.
Real-World Examples of Smishing Scams
Pretending to be a Financial Institution
A common smishing tactic involves posing as a bank and sending a message alerting the victim to an issue with their account. For example, a text might claim that unusual activity has been detected and prompt the victim to click a link to verify their account. The link takes users to a fake banking website where sensitive data, including login passwords, is collected.
Pretending to be the Government
Scammers might impersonate government agencies such as the IRS or local law enforcement. For instance, a text might inform the victim of unpaid taxes and threaten legal action unless immediate payment is made through a provided link or phone number. This technique exploits the fear of legal repercussions to coerce victims into compliance.
Pretending to be Customer Support
Attackers may pose as customer support agents from well-known companies like Amazon or Microsoft. The message may claim that there is an issue with the victim’s account or that they are entitled to a refund. The victim is directed to a fake website where they enter their personal information, which is then stolen.
Pretending to be a Shipper
During peak shopping seasons, such as the holidays, scammers often pose as shipping companies like FedEx or UPS. The message may claim that a package could not be delivered and prompt the victim to provide their address or pay a delivery fee. The goal of these scams is to obtain cash and personal data.
Pretending to be a Boss or Colleague
In business text compromise, similar to business email compromise, attackers impersonate a boss, coworker, or colleague. The message might request immediate action, such as transferring funds or sharing sensitive information. This type of attack exploits the trust and authority associated with workplace relationships.
Pretending to Text the Wrong Number
In this long-term scam, the attacker sends a message intended to appear as though it was meant for someone else. When the victim responds to correct the “mistake,” the scammer engages them in conversation, building trust over time. Eventually, the scammer requests money or personal information under the guise of a fake investment opportunity or financial emergency.
Pretending As If You’re Locked Out of an Account
In multifactor authentication (MFA) fraud, the attacker already possesses the victim’s username and password. They send a text pretending to be a friend, claiming to be locked out of their account and asking the victim to receive an MFA code on their behalf. The victim unwittingly provides the code, allowing the attacker to access their account.
Pretending to Offer Free Apps
Some of these scams entice victims to download seemingly legitimate apps, such as file managers or antivirus software. In reality, these apps contain malware that can steal personal information, monitor device activity, or lock the victim out of their device until a ransom is paid.
How to Prevent Smishing
The potential consequences of smishing attacks can be severe, but fortunately, there are several steps individuals and organizations can take to protect themselves.
1. Do Not Respond: One of the simplest yet most effective ways to protect against smishing is to avoid responding to suspicious messages. Even prompts to reply with “STOP” to unsubscribe can be used to identify active phone numbers. Refrain from engaging with any unsolicited or suspicious texts.
2. Slow Down and Assess Urgency: Messages that convey a sense of urgency or demand immediate action should be approached with caution. Scammers rely on creating panic to prompt hasty decisions. Take a moment to assess the situation and verify the legitimacy of the message through other channels.
3. Verify Through Official Channels: If you receive a message from a bank, retailer, or government agency, do not use the contact information provided in the text. Instead, visit the official website or call the official customer service number to verify the message’s authenticity.
4. Avoid Clicking on Links: Avoid clicking on links in unsolicited or suspicious text messages. Instead, navigate to the official website manually by typing the URL into your browser. This reduces the risk of being redirected to a phishing site.
5. Check the Phone Number: Be cautious of messages from unfamiliar or unusual phone numbers. Legitimate organizations typically use recognizable contact information. Odd-looking numbers, such as those with only four digits, can indicate an email-to-text service used by scammers.
6. Do Not Store Sensitive Information on Your Phone: Avoid storing credit card numbers, passwords, or other sensitive information on your phone. If this information is not readily available on your device, it cannot be easily stolen in the event of a smishing attack.
7. Use Multi-Factor Authentication (MFA): Enabling multi-factor authentication (MFA) adds an extra layer of security to your accounts. Even if an attacker obtains your password, they will need a second form of verification to access your account. Opt for stronger MFA methods, such as authentication apps, over SMS-based codes when possible.
8. Never Provide Passwords or Recovery Codes via Text: Never share passwords or account recovery codes through text messages. Legitimate organizations will never request this information via SMS. If you receive such a request, it is almost certainly a scam.
What If You Become A Victim of Smishing?
Despite best efforts, it is possible to fall victim to a smishing attack. If this happens, immediate action can help mitigate the damage.
- Notify Your Wireless Carrier and Financial Institutions: Report the suspected attack to your wireless carrier and any financial institutions associated with the compromised information. They can take steps to protect your accounts and prevent further unauthorized activity.
- Place a Hold on Affected Credit Cards: Contact your credit card company to place a hold on any affected cards. This can prevent further fraudulent transactions.
- Reset Passwords and PINs: Change the passwords and PINs for all compromised accounts. To improve security, give each account a strong, distinct password.
- Monitor Financial and Online Accounts: Keep a close watch on your financial accounts and online profiles for any unusual activity. Early detection of unauthorized transactions or logins can help prevent further damage.
- Educate Yourself and Others: Stay informed about the latest smishing tactics and share this knowledge with friends, family, and colleagues. Awareness is a powerful tool in preventing future attacks.
- Scan for Malware: Use reputable antivirus software to scan your device for malware. Remove any malicious software that may have been installed as part of the attack.
- Report to Authorities: Report these attacks to relevant authorities, such as the Federal Trade Commission (FTC) in the United States, to help combat the broader issue of cybercrime.
Frequently Asked Questions (FAQs)
Q 1. How does smishing vary from phishing, and what does it mean?
A. This term combines “SMS” and “phishing,” involving text messages that deceive recipients into divulging personal information or clicking malicious links. Unlike phishing, which primarily uses email, smishing exploits the trust associated with text messages to trick victims.
Q 2. What are some common signs of a smishing attempt?
A. Signs include messages from unknown numbers, urgency-inducing texts about account issues, requests for personal or financial data, suspicious links or attachments, and poorly formatted messages from supposed legitimate sources.
Q 3. How can I protect myself from falling victim to smishing attacks?
A. Avoid responding to suspicious texts or providing personal details. Refrain from clicking links in unsolicited messages, verify messages through official channels, use multi-factor authentication (MFA), and employ reputable antivirus software.
Q 4. What should I do if I realize I’ve fallen victim to a smishing attack?
A. Notify your carrier and financial institutions immediately. Freeze compromised cards, reset affected passwords and PINs, monitor accounts for unusual activity, scan devices for malware, and report the attack to authorities like the FTC.
Q 5. Can legitimate organizations send important info via SMS, and how can I verify it?
A. Legitimate organizations may use SMS for alerts or updates, but they won’t ask for sensitive information. Verify authenticity by contacting the organization directly through official channels, such as their website or customer service.
Conclusion
Smishing is a growing and clever threat that uses the popularity and trust of text messages to trick and exploit people. By knowing how it works and the different types of attacks, you can better protect yourself and your organization from these scams.
Staying vigilant, adopting best practices for mobile security, and promptly addressing any incidents can significantly reduce the risk and impact of smishing.