As we approach the holiday season, we would like to make you aware of a growing cyber threat known as SMS phishing, aka “Smishing,” and, more important, how to stay safe. Have you ever received unsolicited mobile text messages from an unfamiliar number, containing a strange web link that prompts an “urgent” response from you? This is an example of what’s called “Smishing”.
Smishing, a combination of “SMS” and “phishing," is a form of phishing where the attempt is delivered via text message. Victims will receive a deceptive message that is intended to lure them into divulging some personal information that the cyber scammers can use for exploitation. Most commonly, they will prompt you to enter your personal or financial details. These scammers will attempt to disguise themselves as banks, governmental agencies, or some other company to lend legitimacy and/or authority to their claims.
Smishing messages can look different. Some may claim that you have won a grand prize, and request that you share some details in order to redeem it. Others may claim that you are in financial trouble and offer a way out. While they may come in different flavors, a few telltale signs remain the same:
Unfamiliarity -- unknown phone numbers or odd phone numbers (e.g., 5000)
Urgency -- appeals to “act quick”
Links -- redirection links to an external site where they expect to extract information
Information -- requests for personal/financial details
DO NOT
Click on any links.
Reply to the message.
Provide any personal information (including OTPs, ATM codes, confirmation codes).
DO
Delete the message.
If the message appears to be from the bank or some governmental agency, go online to their official website and find their email/phone number and reach out to see whether this request has come from them.
Report the Smishing attempt to the FCC.
Want to keep up with the latest IronNet threat intelligence and research? Visit our threat intelligence hub.