What is Smishing? How does it affect you?

Smishing, a portmanteau of “SMS” and “phishing,” is a type of cyber attack that uses text messages (SMS) to deceive recipients into revealing sensitive information, such as passwords, personal data, or financial information. Like email phishing, smishing relies on social engineering tactics to manipulate and exploit human vulnerabilities.

Smishing attacks often involve text messages that appear to come from reputable sources, such as banks, government agencies, or familiar businesses. The messages typically create a sense of urgency or fear, prompting the recipient to take immediate action. This action may involve clicking on a malicious link, replying to the message with sensitive information, or calling a fraudulent phone number.

Attackers may use the collected information for various purposes, such as identity theft, unauthorised access to online accounts, or financial fraud.

Here we’ve discussed the various type of smishing campaigns reported and also how to stay vigilant and protect yourself from such attacks.

Also read: What is a Whaling Cyberattack? How is it different from Phishing?

---

Types of Smishing attacks

Cybercriminals continue to exploit text messaging to deceive individuals and steal sensitive information. During the COVID-19 pandemic, there have been reports of smishing attacks related to health information, stimulus payments, and contact tracing. These scams prey on people’s fears and uncertainties, tricking them into providing personal information or downloading malicious software. Some examples of smishing attacks include:

• Bank smishing scams: In these cases, attackers pose as a bank or financial institution and send text messages to potential victims, alerting them about suspicious account activity, locked accounts, or required updates. The message usually contains a link that directs the recipient to a fake website designed to look like the bank’s official site, where they are asked to enter their login credentials, personal information, or account details.
• Tax-related smishing scams: Attackers may pretend to represent tax agencies, such as the IRS in the United States or HMRC in the United Kingdom, and inform the recipient of a tax refund or outstanding payment. The victim is then asked to click on a link or provide personal information to claim the refund or resolve the payment issue.
• Delivery smishing scams: In these instances, cybercriminals impersonate well-known delivery companies, such as UPS or FedEx, and send text messages claiming that a package is being held or requires additional information to be delivered. The victim is then asked to click on a link or provide personal details to resolve the issue.

These are just a few examples of the various types of smishing attacks. It is crucial to be aware of these scams and take necessary precautions to protect yourself from falling victim to them. Always verify the authenticity of the sender, avoid clicking on suspicious links, and never provide sensitive information via text message.

---

Precautions against Smishing attacks

To protect oneself from smishing attacks, it is essential to:

• Be cautious of unsolicited text messages, especially those that request personal or financial information.
• Verify the authenticity of the sender before taking any action. Contact the purported source using a known, legitimate phone number or email address.
• Avoid clicking on links in suspicious text messages. Instead, type the website’s address directly into your browser or use a bookmark you’ve created previously.
• Keep your mobile device’s operating system and security software up to date.
• Report suspected smishing attempts to the appropriate authorities, such as your mobile carrier, financial institution, or government agency.

By following these steps and staying vigilant, you can minimise the risk of falling victim to smishing attacks.

Also read: What is Vishing Cyberattack? Tips to protect yourself