You may have heard of phishing before. This is a criminal practice of sending fake emails to trick users into divulging their sensitive personal information (passwords, bank details, etc.).

Now, note that this practice is also done by SMS, and it’s called “smishing”. The principle is the same: obtaining personal information using fake SMS. It has become worryingly commonplace, but don’t worry, you can protect yourself. Let’s get you informed, shall we?

What is smishing and how does it work?

Smishing is phishing by text messages (SMS) and not by e-mail, hence the name; smishing = SMS + phishing. Some classifications include phishing via messaging apps in smishing, but for us, this is a separate category, and we won’t discuss it here.

The goal is, as with any phishing attempt, to trick recipients into disclosing sensitive information, such as their online bank account password or credit card details. To do this, the scammers send text messages, often about a non-existent problem (delivery problem, unpaid invoices, or blocked account), which the recipients must settle by clicking on a link.

There are then two possible scenarios:

Scenario 1: The link infects the victim with malware that pretends to be a legitimate application but whose real purpose is to obtain important information. 

Scenario 2: It sends the victim to a web page disguised as a legitimate website whose real purpose is to obtain important information.

The scenario that will take place will depend on the favorite tactic of the crooks: malware or a fake site. The result is the same in both cases. Similar situations have resulted in the theft of thousands of dollars and euros. But how come SMS phishing has become so popular lately and why is it more dangerous than basic phishing?

 

 

Why Smishing Is More Dangerous Than Basic Phishing

Most of us are accustomed to phishing emails, and people generally know how to recognize and avoid them. Text messages are less common channels for scamming people, so people tend to think that a small message can’t pose a threat.

Other than that, although people trust SMS more, it tends to be less secure than email. Every remotely decent email service has a clever spam filter. These are not without flaws, but scammers must constantly invent new tactics to circumvent them. Unfortunately, when it comes to flexibility and accuracy, mobile operator spam filters leave something to be desired.

Also, people usually read messages on the fly or while they are doing something else. This, in addition to the fact that they do not expect an SMS to be dangerous, means that they tend to pay less attention to SMS and attacks are more likely to succeed. In other words, when they receive a message, people are likely to ignore the warning signs they know and will just click on the link.

Finally, text messages display fewer signals that would help recognize a scam. When you receive an email, you can see the sender’s address, review the design and layout, and analyze the credibility of the message. In summary, you can see the red flags.

With SMS, even legitimate messages look the same, with short messages using non-standardized language and no formatting to parse. The scammers have the technical ability to steal the sender’s information without it appearing suspicious, by replacing the real number of the latter with a fake one.

How To Protect Yourself from Smishing

Just like with traditional phishing, you need to build strong defenses against smishing.

• Do not click on links or share any information about yourself in an SMS. As they say, the less activity the better.
• Use two-factor authentication wherever you can. Thus, even with a stolen password, criminals will not be able to access your account.
• Contact your bank immediately if you suspect a criminal has gained access to your account. The bank can block your card, change your passwords, and advise you on the steps to follow.

Here are some FAQs to dispel any doubts you may have.

Should I respond to a scam message just to get them to remove me from their mailing list?

Do not do that. The simple act of answering confirms to them that your number is still active. Unsubscribing can be a difficult thing to do, even with legal companies, so don’t expect to find a deal with those who break the law.

What if it’s not smishing but an important message from my bank?

If in doubt, contact your bank directly. It is unlikely that they sent this message. Speaking of which, make sure you get the phone number from a source you know, such as their website. In any case, do not use any numbers or contact details from this SMS.

Is there a way to automatically filter SMS phishing?

Yes! Many security solutions have long used built-in filters to detect suspicious links in text messages and messaging apps. They let you know when it does, and make sure you don’t lose money just because you let your guard down.