What is Smishing? How Can I Protect Myself from Smishing Attacks

[lwptoc]

Smishing, or SMS phishing, refers to phishing attempts made through text messages. It is a form of social engineering where scammers try to trick mobile phone users into giving up sensitive information or installing malware. The term “smishing” comes from combining “SMS” and “phishing.” Unlike email phishing, smishing uses cell phone text messages to lure victims.

Smishing emerged in the early 2000s as text messaging grew more popular. Scammers realised they could exploit SMS technology to launch phishing scams and steal personal data. Early smishing attacks often imitated bank messages asking users to update their information.

Like email phishing, smishing aims to manipulate users into sharing login credentials, bank account details, or personally identifiable information. Smishing may also get victims to click links to phishing websites or download malware onto their mobile devices.

The rise of smishing parallels the growth in mobile phone usage over the last two decades. As more people rely on cell phones for banking, shopping and communication, smishing has become a lucrative channel for cybercriminals. Reports indicate smishing attacks increased significantly during the COVID-19 pandemic as more transactions and activities shifted online.

How Smishing Works

Smishers use SMS text messages to trick users into clicking malicious links or providing sensitive information. They often send mass texts to random phone numbers, hoping some recipients will fall for their scams.

The text messages are crafted to appear legitimate, often pretending to be from well-known companies or services. For example, a smishing text may claim a problem with your bank account and provide a link to “resolve the issue”.

Users who click the link are typically directed to a fake but convincing lookalike website. The site will prompt the user to enter login credentials, personal info, or bank details, which the scammers can then steal.

In other cases, the link may install malware directly onto the user’s phone. This allows the attackers to access contacts, messages, photos, and other data stored on the device.

Smishers can send messages en masse by compromising SMS gateway servers or using SMS spoofing services. These techniques allow them to mask the origin of the texts and make it seem like they are coming from a legitimate sender.

The messages often pressure users to click the link quickly before it “expires” to lure them into falling for the scam. Overall, smishing aims to create a sense of urgency so users act without thinking first.

Smishing vs Phishing

Smishing and phishing are similar cybersecurity threats, but the two have some key differences.

Similarities between Smishing and Phishing:

Both involve scammers attempting to trick users into giving up sensitive information or downloading malware.
Smishing and phishing messages often appear legitimate and urgent to get users to act without thinking.
They rely on social engineering techniques to manipulate users.

Differences between Smishing and Phishing:

Smishing occurs over SMS text messaging, while phishing uses email.
Smishing links tend to be shortened to hide the malicious destination, while phishing includes full URLs.
Smishing texts usually have a sense of urgency and impersonal tone, while phishing emails are often more formal impersonations of trusted sources.
Smishing texts come from phone numbers, which can be spoofed more easily than email addresses.
Phishing scams are generally more sophisticated and elaborate, while smishing relies on blunt techniques.

Overall, smishing and phishing share the goal of deceiving users of information. However, smishing is tailored explicitly to SMS messaging, while phishing focuses on email as the attack vector. Recognising the differences in how they operate can help identify and defend against both threats.

Smishing Techniques

Smishers use various techniques to trick users into responding or clicking on malicious links. Some common techniques include:

Urgent requests: Smishing messages often convey a sense of urgency to pressure the recipient into acting quickly without thinking it through. They may claim a problem with your account that needs immediate attention or that you must act fast to claim a prize or deal.
Spoofed senders: Smishers disguise their messages to make them look like they’re coming from a legitimate company or organisation you trust. They use logos and branding to appear authentic. The message may look like it’s from your bank, credit card company, a government agency, or a major retailer.
Exploiting curiosity: Smishing scams spark people’s curiosity by making intriguing claims that entice them to click for more information. They may promise exclusive deals, celebrity gossip, alerts about packages, or information about a current event. The temptation to find out more overrides caution.
Personalisation: By including personal details like your name or account numbers, smishing messages seem more credible and target you specifically. The scam artists want you to think they have your personal information.
Time sensitivity: Creating urgency by claiming an offer is only available for a limited time, or your time-sensitive response pressures recipients to act without proper evaluation. It triggers a fear of missing out.
Follow-up messages: If you don’t respond initially, smishers may send another message following up as if they are a legitimate company trying to reach you. This further builds believability.

Recognising these common techniques can help you identify and avoid responding to smishing scams. The most important thing is verifying the source before clicking links or providing sensitive information.

Smishing Examples

Smishers use clever techniques to trick users into providing sensitive information or downloading malware. Here are some real-world examples of smishing scams:

Messages claiming your package is delayed and providing a fake tracking link. Clicking installs malware.
Texts about your bank account being frozen. It prompts you to call a number answered by scammers posing as your bank.
You are receiving a text that you’ve won a gift card to Starbucks, Amazon, etc. It leads to a phishing site stealing your login credentials.
A text message states that your iPhone warranty has expired, and you must click to renew it. The link infects your phone with spyware.
Messages pretending to be from a ” stranded ” friend who needs money urgently. The scammers trick you into sending gift cards.
Texts about “unauthorised activity” on your Apple account. It gets you to click a link, giving away account access.
Fake customer service messages asking you to verify account information. The scammers steal your data.
Receiving an unexpected MMS video file that secretly installs malware if opened.

The common thread is scammers pretending to be legitimate companies or contacts to build trust. Stay vigilant against suspicious texts, and don’t click links from unknown sources. These examples showcase the creativity of smishing attacks.

How to Identify Smishing Messages

Smishing messages often share common characteristics that can help you identify them as scams. Here are some tips for spotting suspicious text messages:

Generic greetings – Smishing texts frequently start with generic greetings like “Dear customer” instead of using your name. This is a sign they were sent out randomly and not personalised.
Sense of urgency—Smishers try to create a false sense of urgency, demanding immediate action and threatening that your account will be closed or that you’ll face other consequences. Real companies generally don’t threaten customers this way.
Unexpected messages – If you receive a text about an account you don’t have or a delivery you didn’t order, it’s likely a scam. Smishers send messages randomly hoping some will hit.
Suspicious links – Never click links in unexpected messages. Smishing links often use odd spellings or domains instead of legitimate company sites. Hover over links to see the actual URLs.
Requests for information – Smishers may ask you to verify personal information like passwords or Social Security numbers. Real companies don’t ask for sensitive info over text.
Poor spelling/grammar – Messages with multiple spelling and grammar errors likely come from scammers, not legitimate businesses.
No opt-out—You cannot receive future texts, but real companies allow you to opt out.

Stay vigilant about any text messages that have these red flags. When in doubt, contact the company directly through their official website or customer service line to verify a legitimate message.

How to Protect Yourself from Smishing

Smishing scams can seem convincing, but there are ways to avoid falling victim. Here are some tips for protecting yourself:

Never click on links or download attachments from suspicious texts, even if they appear to come from a legitimate source. Instead, go directly to the company’s website.
Don’t call phone numbers in suspicious texts. Look up official numbers online and call those instead.
Be wary of texts that create a sense of urgency or demand immediate action. Scammers want to rush you into making a mistake.
Carefully examine the full sender name in texts. Scammers often spoof legitimate business names.s
Do not provide your personal information via email or text unless you have initiated it and know who is requesting it. If an organisation (such as your bank) has asked for personal information, they will send you a letter with instructions on how to proceed should there be any changes in policy or procedures.
Never respond to questions about PINs, passwords, account numbers, Social Security numbers and other sensitive information via email or text message – even if it seems like it.
Setup text blocking on your phone and block suspicious numbers. This prevents future smishing attempts from the same sources.
Keep software and apps updated on all devices. Updates often include improved security against phishing and smishing.
Only install apps from official apps like Google Play and Apple App Store. Avoid third-party app stores, which may contain malware.
Be cautious of shortened URLs in texts. Use URL preview tools to examine where they lead.
Turn on two-factor authentication for important accounts whenever possible. This provides an extra layer of login security.
Monitor bank and credit card statements routinely for any suspicious charges. Report issues immediately.

Being cautious, avoiding impulsive reactions, and implementing preventative measures can significantly reduce the risk of falling prey to smishing scams. Educating your friends and family about these scams is crucial to protect them.

If you happen to fall victim to a scam or if your computer gets attacked by scammers, whether through ransomware or phishing, please do not hesitate to contact our malware removal service for assistance.