Five tips to help avoid smishing scams

Smishing is a fast-growing version of one of the internet’s oldest and most successful scams. Like any other type of phishing, smishing aims to trick you into handing over sensitive data and information — only instead of using email, cyber criminals send their messages via text or short message service (SMS). Smish attempts are typically sent to mobile phone users as standard texts, but they can also be sent via popular messaging apps.

Smishing is a form of social engineering, where scammers exploit emotions like fear, sympathy, curiosity or greed to get individuals to divulge personal or business information. They do this by sending fraudulent texts to your phone or other mobile device, purporting to be from a trustworthy source, such as a delivery service, utility company, bank or government agency. The information they seek could include usernames, passwords, credit card numbers, bank account numbers, vendor names or other proprietary data. Cyber criminals then sell that data on the black market or use it to commit identity theft, empty bank accounts or redirect payments to themselves.

Criminals also use compromised phone numbers and spoofed or hacked accounts on popular messaging platforms to fake their identities. Smishing messages often contain links that take users to a website that may look legitimate, but actually steals usernames, passwords and other data when people log in. Some messages can even secretly install malware on victims' mobile devices.

Smishing has become more common, especially during the pandemic. In fact, non-email-based phishing attacks are also proliferating, with vishing (voice phishing), smishing (SMS phishing), and quishing (QR code phishing) increasing sevenfold in the second quarter of 2022.

Smishing is potentially more appealing to cyber criminals because users are more inclined to trust texts over other forms of communication. In fact, people respond to 45 percent of their texts while only 6 percent of emails receive a response.² This is likely due to years of email over-saturation; inboxes inundated by promotional offers and spam have trained users to become more suspicious.

Common smishing scams

Making false promises

Criminals employ a wide variety of smishing tactics to convince people to part with personal data — and money. They may make false promises of:

• Gift cards, prize money, or other winnings
• Low-interest or no-interest credit cards
• Coupons and other discounts
• Student loan debt forgiveness

Posing as legitimate companies

Smish attempts may also allege to be from legitimate companies with questions about your account or transaction. They may:

• Claim to be a customer service representative needing to verify account information
• Want to discuss a recent suspicious charge or problem with your payment
• Send a fake invoice and ask you to contact them if you didn’t authorize the purchase
• Pretend to be a package delivery notification or tracker

Preying on charity

Smishing criminals may even prey upon your charitable impulses by:

• Requesting donations after a natural disaster or other catastrophic event, such as hurricane or wildfire relief
• Posing as people you may know, such as a community organizer or politician, who would collect monetary contributions   

¹ Forbes 

² Gartner