SmishingNot Even Your Phone Is Safe from Fraudsters!

How You Can Identify & Prevent “Smishing,” or SMS Text Scams

Picture this: an email appears in your inbox at work. It’s from your boss; apparently, a vendor — one you know the company uses — is saying you must pay for a shipment now, or a crucial order will be canceled. Your “boss” instructs you to forward him the details for one of your company’s accounts to make the payment.

You don’t panic, though, because you’ve already learned to recognize the red flags of phishing.

This is a common trick that fraudsters use to get you to download malicious software, send money, or disclose sensitive information. Luckily, you’re smart enough to know not to take the bait.

However, what if you received the message as a text sent to your phone, rather than an email? Would you respond the same way?

So-called “smishing” attacks can be just as dangerous as email phishing. From the fraudster’s perspective, though, it can be a much more effective technique, as most targets don’t know how to respond.

What is Smishing?

Smishing

[noun]/s • miSH • əng/

Smishing is the fraudulent practice of using fake text messages in an attempt to steal confidential information, such as passwords or credit card numbers.

Smishing is a portmanteau of “SMS” and “phishing.” As the name implies, it’s a kind of phishing attack, but instead of targeting victims through emails or websites, smishing relies on mobile (SMS) text messaging. It’s just one more way for fraudsters to turn technology against both consumers and businesses. 

Some smishing messages are obviously scams. For example, imagine that a person you’ve never met, and who has no connection to you, sends you a text asking for a “favor.” The favor involves restricted personal or company information such as credit card numbers. It’s an obvious scam, and few people would fall for that.

Other fraudsters are sneakier. The sender is realistic; for instance, they’re posing as a coworker, a manager from another department, or a friend of a friend. The request feels legitimate, as well; the sender’s message is in the voice of the person they’re impersonating. If it’s worded carefully, the message may convince you that it’s authentic.

In most cases, smishers are after confidential information. For example:

• Credit card or online account credentials
• Banking or other financial info
• Work login passwords and usernames
• Internal business directories
• Social Security numbers
• ZIP codes
• Customer or vendor lists

Yes; even something like a vendor list would allow them to target specific individuals in the company, like the CEO or CFO.

How Do Smishing Attacks Work?

Smishing attempts can come from standard messaging apps, non-SMS messaging like WhatsApp, or even through social media messaging. Attacks targeting businesses can, in some cases, use a company directory to make the messages seem more legitimate.

There are myriad scams that smishers can use to manipulate victims into taking a desired action. The most popular tricks we’re seeing currently include:

• Free Covid testing (or stimulus money)
• Overdrawn accounts or past-due payment warnings
• Getting paid for answering surveys
• Receiving gifts or rewards
• Compromised account warnings
• Order or delivery confirmations
• Phony apps update
• Notice of attempted delivery
• Friend, family, or colleague's emergency

As for the action in question, smishers tend to follow one of three strategies when they attack:

This may be a link to a site or malware, as we saw above. It could also be a request for account information to “confirm” a transaction. When businesses are targeted, it may seem like a simple request that reveals company data.

How Smishing Impacts Businesses

Smishing can be a real nightmare for businesses.

Instead of targeting random individuals, hackers target employees of a specific business, then try to trick those employees into giving away sensitive information. The scams are simple: a cybercriminal may pose as a company executive asking for an account number, or telling an employee to pay an invoice from their own account. If this sort of attack is successful, it can have a major, long-lasting impact on the business’ reputation and financial future. You could see:

• Business disruption
• Loss of customer confidence (especially in cases of data breach)
• Loss of company value/investors
• Reputational damage with vendors, banks, etc
• Potential fines and fees (in cases that involve theft of customer data)
• Loss of intellectual property, research findings, trade secrets, or proprietary designs.

How Big of a Problem is Smishing?

Smishing already poses a huge threat, but that threat is growing as people spend more time communicating on their devices. In some cases, it may even work better than conventional phishing. This is true for a variety of reasons:

Red Flags of Smishing

One of the most important steps in smishing protection is to recognize some of the warning signs. For businesses, this means making sure your staff is aware of some of the triggers.

Obviously, none of these conclusively prove that a message is fraudulent. But, when taken together, they might be cause for closer examination:

How to Defend Against Smishing Attacks

So, what should you do if you receive a strange text message, and suspect it may be a smishing attempt? Here are a few recommendations:

• Respond Visa Official Channels: If you have any doubts at all about a text’s legitimacy, contact the alleged sender directly using official channels.
• Don’t Engage: Any prompt to reply, even something as simple as texting “STOP” to unsubscribe, can be a trick to identify active phone numbers.
• Check the Phone Number: Does the sender’s number seem legitimate? Scammers have an entire range of tactics to mask their phone numbers.
• Slow down: Stop and consider urgent account updates and limited-time offers. Is it really important to act in that moment? Does the threat make sense?

The threat from smishing continues to grow, and that probably won’t change. But, there is no better tool to use against smishing than education. You need to teaching yourself, as well as your employees, to identify, report, and negate smishing threats.

Of course, there’s a lot more to fraud prevention than identifying smishing attacks. True fraud prevention and risk mitigation require a more comprehensive approach. If you’d like to know more, contact Chargebacks911® today.