SMISHING

Disclaimer: Copyright infringement not intended.

Context

In today's digital age, where smartphones are practically an extension of ourselves, smishing poses a real and growing threat.

Details

Smishing

• Smishing, derived from “SMS” and “phishing,” is a type of cybercrime that uses deceptive text messages to manipulate victims into divulging sensitive personal information such as bank account details, credit card numbers and login credentials.
• Just as with phishing emails, the goal of smishing is to trick individuals into revealing private information that can be used for identity theft, financial theft or other fraudulent activities.
• Given the prevalence of text messaging as a form of communication, smishing has become a significant concern in cybersecurity. Learn more about phishing, how it works and how to spot a phishing attack.

Smishing vs. Phishing

• Both smishing and phishing are forms of cyberattacks that trick individuals into providing personal, sensitive information. They primarily differ in their methods of delivery and the technologies they exploit.

Phishing

• This is a broader term for a method of deceptive communication intending to trick recipients into revealing sensitive information, such as usernames, passwords, credit card numbers or Social Security numbers.
• Typically, phishing attacks occur via email. The attacker sends a seemingly legitimate email that encourages the recipient to click on a link.
• This link then leads to a fraudulent website that resembles a trusted site where the recipient is prompted to enter their sensitive information.

Smishing

• This is a form of phishing that uses Short Message Service (SMS), commonly known as text messages, instead of email.
• Typically, the scammer poses as a legitimate institution, such as a bank, a service provider or a reputed company.
• The text message they send creates a sense of urgency or threatens consequences if the victim doesn’t respond immediately.
• It downloads malware on the phone or includes a link to a fraudulent website designed to look like the legitimate organization’s site. When victims reach that site they are tricked into entering their personal information.

Types of Smishing

Smishing attacks can take several forms, each with its own approach but all ultimately aiming to trick victims into divulging sensitive information or performing actions beneficial to the attacker.

• Impersonation Scams: The attacker pretends to be a known organization or individual. The attack could be via a message pretending to be from a bank, government agency or a reputable company.
• Tech Support Scams: Attackers pose as representatives from tech companies, claiming that the victim’s device or account has been compromised and that they need sensitive data to fix the problem.
• Account Suspension Scams: These messages claim that an account (bank account, social media or any other service) has been suspended and prompt the victim to verify their identity by providing sensitive information.
• Missed Delivery Scams: Attackers send messages claiming that the victim has missed a package delivery, and they need to provide personal details or a fee to reschedule the delivery.
• Prize or Lottery Scams: Messages claiming that the victim has won a prize or a lottery, and they need to provide personal details or make a payment to claim the winnings.
• Charity Scams: In these attacks, scammers impersonate a charitable organization, asking for donations, usually following a large-scale disaster or during holiday seasons.
• Malware Link Scams: Messages containing a link, which when clicked, installs malware on the victim’s device, allowing the attacker to steal information or gain control over the device.

What Is a Smishing Attack?

• A smishing attack is a type of cybercrime that uses deceptive SMS text messages to trick recipients into providing sensitive information such as passwords, credit card numbers or other personal data. A smishing attack exploits the trust that people have in text messages.
• In a smishing attack, a criminal sends a text message pretending to be from a legitimate and trusted source, such as a bank, government agency or reputable business.
• This message typically creates a sense of urgency, often claiming that immediate action is needed to avoid serious consequences.
• For instance, the message might state that your bank account will be frozen if you don’t verify your banking details immediately.
• The message usually contains a link to a fraudulent website designed to look like the legitimate entity’s site.
• When victims click on the link, they’re taken to the fake site and encouraged to enter their personal information, which the attacker then captures. Alternatively, clicking the link may download malicious software that can steal information directly from the victim’s device.

How Does Smishing Work?

• Smishing works by leveraging social engineering techniques, manipulation and deceit to trick victims into providing sensitive information. As people trust text messages more than emails, fraudsters have started using them for their schemes.
• Crafting a Compelling Message: The attacker first crafts a deceptive SMS text message. This message typically mimics a legitimate institution such as a bank, a government agency or a well-known business. The text is designed to elicit a sense of urgency or fear, prompting immediate action from the recipient.
• Sending the Message: The attacker then sends this message to the intended victim. The phone number or name that shows up on the recipient’s phone is often spoofed to appear legitimate, further convincing the victim of the message’s authenticity.
• Creating a False Need: The message usually instructs the recipient to take immediate action to avoid a negative consequence. For example, it might claim that the recipient’s bank account is about to be suspended or their credit card information needs to be confirmed.
• Providing a Solution: The solution typically involves clicking on a provided link or replying to the message with personal information. The link may direct the victim to a fraudulent website, which is designed to closely mimic a legitimate website. Here, the victim may be prompted to input sensitive data such as usernames, passwords or credit card details.
• Collecting Information: Once the victim enters their information into the fraudulent site, the attacker collects this data. This can lead to serious ramifications such as identity theft or financial fraud.
• Malware Installation: In some cases, clicking on the link may also download malware onto the victim’s device, which can further compromise security and privacy by providing the attacker with ongoing access to the victim’s device and data.

Examples of Smishing Attacks

• Bank Fraud Alert: A text message appears to be from your bank, stating that there’s been suspicious activity on your account. It asks you to confirm your identity by clicking a link and entering your account details.
• Missed Delivery Notification: You receive a text from what appears to be a delivery service such as FedEx or DHL. The message states that you missed a package delivery and asks you to click a link to reschedule, often requesting personal information or a small fee.
• Account Verification: A message claims to be from a popular online service (such as Amazon or PayPal) suggesting that there’s a problem with your account. It requests you to verify your account details by following a link and entering your login information.
• Tech Support: A text message warns that your computer has been infected with a virus. The message, supposedly from a known tech company, urges you to install an “antivirus” by clicking on a provided link, which is actually malware.
• Gift Card Winnings: You receive a text that congratulates you on winning a substantial gift card for a popular store. To claim the prize, you need to click on a link and provide some personal details for verification purposes.

How to Protect Against Smishing

Protecting against smishing attacks involves a combination of awareness, vigilance and adopting certain precautionary measures.

• Poor grammar and spelling: Many smishing messages contain grammatical errors or spelling mistakes, indicating that they may not be from a legitimate source.
• Unsolicited requests for personal information: Be wary of messages that request sensitive information like passwords, Social Security numbers, or banking details. Legitimate organisations typically won't ask for this information via text message.
• Suspicious links: Hover over any links in the message (without clicking them) to see the URL. If it looks suspicious or doesn't match the purported sender, it's likely a smishing attempt.
• Question everything: If a message seems too good to be true or raises suspicions, trust your instincts. Take a moment to analyse the message critically before taking any action.
• Verify the sender: Before clicking on any links or providing sensitive information, verify the sender's identity. Contact the institution directly using official contact information to confirm the legitimacy of the message.
• Don't get pressured: Scammers thrive on urgency. Take a step back and evaluate the situation calmly. Legitimate organisations won't pressure you to act immediately or threaten consequences for inaction.
• Keep software updated: Ensure your smartphone's operating system and security software are up to date to protect against malware and other threats. Consider installing reputable antivirus apps for an added layer of protection.

Conclusion

The effectiveness of smishing relies largely on the recipient’s trust in the source of the message and their reaction to the urgency conveyed in the message. By being aware of smishing tactics, individuals can better protect themselves from falling victim to such attacks.

PRACTICE QUESTION What are the primary cybersecurity threats facing individuals and organizations today, and how do they continue to evolve? 150 words