What is Smishing?

Have you’ve heard of Phishing. This is a cybercrime that uses scam emails to defraud users into giving away sensitive personal information such as passwords or financial details. With the advent of text messaging, a variant that uses texts instead of emails has made its way to the digital universe.

Smishing, SMS + Phishing = Smishing, is now overtaking Phishing as one of the most effective scamming tools in the bad actor’s cybercrime toolkit.

Smishing uses fake SMS (mobile phone text) messages to gain your info in ways similar to phishing emails.

Remember the last time you’ve interacted with a brand, political cause, or fundraising campaign via text message? You probably have noticed these communications are occurring far more frequently.  It’s no accident. There is mounting evidence that email opens or users accepting push notifications from apps are no longer effective tools to cause users to act. But 98% of SMS messages are read within seconds of being received. Cybercriminals are many things, but stupid is not one of them. They follow user behavior and patterns, and they adjust their attacks (social engineering) to the ones that work the best. Smishing is now a leading technique for scamming, and the bad actors are ramping up their attacks.

There is a psychology behind Smishing

With the world quickly going to a mobile-dominated world, the more prevalent scams like Smishing will become. Evidence shows people have gotten used to and smarter about email spam, but they are also showing signs they are less likely to doubt an SMS message’s legitimacy.

The Smishing scammers rely on your quick reaction to a message that may appear identical to an actual message from, for example, your credit card company. Like many “in your face” scams, one of the primary techniques the bad actors use is to create “URGENCY.” So, they use message titles that indicate the need for an immediate response, such as – “Urgent!” or “Reply now!”. The less you think, or quicker you respond, the better it is for the scammers. But, even if you give the message a good look-over, it’s still possible you could be fooled.

The end goal is to trick a user into an action that plays into the hands of cybercriminals. Smishing campaigns, in particular, often follow natural disasters as scammers try to prey on people’s charitable nature to scam those funds into their own pockets.

Smishy phone numbers.

Some smishes may come from strange phone numbers, but often they will use the name of a business, a cellular shortcode, or more recently come from area codes in the same geographic area as you are located in to fool you into thinking they may be from someone you know.  So always question any text message that isn’t from someone you know to be trustworthy.

McAfee Mobile Security for Android Devices

Buy Now

We earn a commission if you make a purchase, at no additional cost to you.

How to prevent being Smished

New and innovative technology is great, but it has also created more ways to be ripped off.  If a text message, from an unknown number promising to get rid of your car loan (but only if you act fast), hits your phone, and it raises your suspicion (because you have no car loan), then you’re already on the right path to avoid falling for smishing scams.

Here are some other good practices to avoid these attacks:

• Use your Spidey sense.

1. 1. Check for spelling errors and grammar mistakes
   2. Go to the sender’s website rather than responding to the message
   3. Verify the sender’s telephone number to make sure it matches that of the company it suggests it belongs to

• NEVER provide financial or payment information on any app or Site that you are not 100% sure is trustworthy.
• NEVER click on links from unknown senders or those you do not trust.
• DO NOT trust “act fast,” “sign up now,” “you’re a winner,” or any other aggressive and “too good to be true” offers.
• Type web addresses into your device’s browser rather than clicking on the link.
• Install a mobile-compatible quality antivirus/antimalware tool on your smart devices.