Smishing

Last updated on May 18, 2022

What is smishing?

Smishing is a type of phishing attack that uses short message service (SMS) text messages to trick victims into giving up personal information or installing malicious software.

How does smishing work?

Smishing attacks usually begin with a text message that appears to be from a legitimate source, such as a bank or a government agency. The message may say there is a problem with the victim’s account or that the recipient needs to take action to avoid some kind of negative consequence. The message will often include a link or phone number that the victim is instructed to click on or call. If the victim responds, they may be taken to a fake website that looks real but is designed to steal personal information or infect the victim’s device with malware. In some cases, the attacker may simply reply to the victim’s text message and try to engage in conversation in order to extract personal information.

What are the most common types of smishing attacks?

One common type of smishing attack is known as “SIM swapping.” This occurs when an attacker tricks a victim’s mobile service provider into transferring the victim’s phone number to a SIM card controlled by the attacker. Once the attacker has control of the victim’s phone number, they can use it to reset passwords and gain access to online accounts. Another common type of smishing attack is known as “fishing.” This occurs when an attacker uses an automated voice system (often known as “robocalling“) to leave a recorded message on a victim’s phone. The message may claim there is a problem with the victim’s account or that they need to take some kind of action, such as calling a phone number or visiting a website. If the victim responds, they may be taken to a fake website or tricked into giving up personal information.

How can I protect myself from smishing attacks?

There are several things you can do to protect yourself from smishing attacks:

• Do not respond to unsolicited text messages, even if they appear to be from a legitimate source.
• Do not click on links or call phone numbers included in unsolicited text messages.
• Do not give out personal information in response to an unsolicited text message.
• Install security software on your mobile device and keep it up-to-date.
• Be cautious of any text messages that create a sense of urgency or require you to take immediate action.
• If you think you may have been a victim of a smishing attack, contact your mobile service provider and your financial institution immediately.

What should I do if I think I’ve been a victim of a smishing attack?

If you think you may have been a victim of a smishing attack, there are several things you should do:

• Contact your mobile service provider and your financial institution immediately.
• Do not respond to any further communications from the attacker.
• Delete any text messages or voicemails from the attacker.
• Install security software on your mobile device and keep it up-to-date.
• Change any passwords that may have been compromised.
• Monitor your accounts for any unusual activity.

If you have received a suspicious text message or voicemail, you can report it to the Federal Trade Commission (FTC) at https://reportfraud.ftc.gov/.

What is the history of smishing?

Smishing is a relatively new phenomenon and has only become common in the last few years. However, there have been a few notable smishing attacks in the past. In 2013, for example, an attacker used a smishing attack to gain control of a victim’s PayPal account and then used the account to make over $100,000 in fraudulent charges. In 2015, another attacker used a smishing attack to gain control of a victim’s Twitter account and then used the account to send out tweets containing links to malicious websites. And in 2016, yet another attacker used a smishing attack to gain control of a victim’s Netflix account and then used the account to watch movies and TV shows without the victim’s permission.

Who is most at risk from smishing attacks?

Anyone with a mobile phone is at risk of being targeted by a smishing attack. However, there are certain groups of people who are more likely to be targeted:

• People who have recently switched mobile service providers or upgraded their phones are more likely to be targeted by “SIM swapping” attacks.
• People who use their phones for online banking or other financial transactions are more likely to be targeted by “fishing” attacks that try to trick them into giving up personal information.
• People who have publically listed their phone numbers online are more likely to be targeted by “spoofing” attacks that use automated voice systems to leave recorded messages.

What are the most common targets of smishing attacks?

The most common targets of smishing attacks are online banking and other financial institutions, social media sites, and email providers. However, any organization that uses text messages to communicate with its customers or employees is at risk of being targeted.

How can businesses protect themselves from smishing attacks?

There are several things businesses can do to protect themselves from smishing attacks:

• Train employees on how to identify and report suspicious text messages.
• Do not use text messages to communicate sensitive or confidential information.
• Implement security measures, such as two-factor authentication, to protect customer accounts.
• Monitor text message traffic for suspicious activity.
• Cooperate with law enforcement agencies if you become the target of a smishing attack.