What is Smishing in Cybersecurity and How to Protect Yourself
Smartphones have changed the way we live. They have connected the world, brought innumerable businesses into existence, and provided us with a wealth of information at our fingertips. However, with all the good they do, all the personal information we pour into our phones can be a huge security risk. The cybersecurity professionals at Proofpoint claimed that smishing attacks had risen by 328 percent in 2020. What is smishing in cybersecurity and what do they have to do with our phones? Let’s take a look.
Related: What is Cyber Security?
What is Smishing in Cybersecurity?
Smishing is a type of cyber attack. The attackers send the target an engaging text message to their phones, which is used to trick them into clicking on a link. This link shares private information from the target’s smartphone with the attacker or even installs malicious software onto the target’s smartphone.
According to Statista, 6.64 billion people, worldwide, use a smartphone. Each one of these phones can send and receive text messages. This makes them particularly vulnerable to smishing-style cybersecurity attacks. While most people are aware of the risk of clicking dangerous links in emails, very few people know about the risk associated with clicking links in texts. In fact, the Proofpoint 2020 State of the Phish report claims that less than 35 percent of people polled even knew what smishing was.
ALSO READ: Why Cybersecurity Threats are Rising and How to Fight Them
How Does Smishing Spread?
Smishing messages can be sent through traditional SMSes as well as web-based messaging apps. Users are often very trusting of text messages and have false confidence in their safety. As a result, it is much easier for attackers to conduct smishing attacks.
Android devices, being the market majority, are the ideal target for smishing attacks. However, although iOS has an excellent reputation for strong security, that does not protect iOS device users from phishing-style attacks. This false comfort can leave iOS users vulnerable.
As smartphones are capable of multitasking, users often fall victim to smishing attacks when they click links in a hurry. It doesn’t help that these messages are disguised as mundane messages from your bank or local retailers.
How Does Smishing Work?
Smishing attacks work just like email phishing attacks. Attackers send text messages to their victims, asking them to click a link or request private data by posing as trusted sources. Attackers can seek several different types of information, such as online login credentials, private information, or financial data, among others.
Smishers can use various techniques to trick victims into sharing their private information. They often pose as someone the victim trusts or use a compelling message along with a link. The link leads the victim to a fake site designed to collect their information or might even install malware on their phone.
Examples of Smishing Attacks
With how common smartphones are today, smishing attacks are far from unusual. Here are some examples of smishing attacks commonly seen by cybersecurity professionals.
Early Access Apple iPhone 12 Scam
In September 2020, a smishing attack was seen where victims were tricked into providing their credit card information in exchange for a free iPhone 12. The text message sent to the victim claimed that a package delivery had been delivered to the wrong address. The link in the text sent the victim to a phishing site that was disguised as an iPhone chatbot.
USPS and FedEx Scams
In September 2020, a false package delivery SMS scam surfaced. The texts claimed that the victim had missed a package delivery and provided a link to a fake FedEx or USPS survey. Here the user would have to fill in their information to recover the said package.
Mandatory Online COVID-19 Test Scam
In April 2020, there were reports of smishers impersonating US government officials in text messages which asked people to take mandatory COVID-19 tests. These smishers claimed that tests could be taken online through the link they provided.
5 Types of Smishing Attacks
While the basic methodology of smishing attacks is similar, the premise of each message can vary widely. Here are a few common scam types which are well-known to cybersecurity professionals around the world:
1. COVID-19 Smishing
These attacks imitate government aid programs or healthcare initiatives. Attackers usually target the victims’ fears related to their health or finances.
2. Financial Services Smishing
These attacks usually imitate messages from financial institutions like banks or credit card companies. Attackers will pose as the financial institution asking users to do things like provide their credentials to unlock their accounts.
3. Gift Smishing
These scams offer users attractive gifts like free services or products. Keywords in these messages include giveaway contests, shopping rewards, or free offers.
4. Invoice or Order Confirmation Smishing
These scams involve false confirmations of purchases or billing invoices for services. These messages play on the victim’s fear of unwanted charges.
5. Customer Support Smishing
Here, attackers pose as customer support representatives looking to help victims resolve an issue. The attackers start the attack by claiming that there are issues with the victim’s account and provide them with steps for resolving it.
How to Avoid Smishing Scams?
Avoiding these scams is relatively easy if one understands what is smishing in cybersecurity. The primary goal is to be mindful of each text message that you receive on a smartphone, especially ones that feature clickable URLs. The simplest way to prevent yourself from falling into a smishing trap is to never respond to or interact with suspicious messages. Even if a message seems urgent, it is best to slow down and read it with a critical eye. Being skeptical is your best tactic.
If you receive a suspicious message from a trusted source like your bank or a merchant, call them directly. Most legitimate institutions will not request you to send them account login info or one-time passwords.
When a message is suspicious, avoid using any of the information provided in the message. Instead, check with official channels to verify the legitimacy of the information in the text. Also, refrain from keeping financial info like credit card details on your phone. Downloading anti-malware apps on your phone can also be immensely helpful in keeping you protected.
The Difference Between Smishing and Phishing?
The difference between phishing and smishing is very simple. The fundamental difference is the channel of the attack. Phishing attacks are usually conducted over emails where links in emails send victims to fraudulent sites which collect their information. Smishing attacks, on the other hand, use text messages to send links to their victims.
Smartphones form a channel of communication that we are constantly tapped into. According to a Reviews.org survey, 47 percent of Americans claim to be addicted to their phones. This gives malicious elements unprecedented access to unassuming victims. This rampant rise in cyberattacks like smishing has added to the demand for cybersecurity professionals. Now that you know what is Smishing in cybersecurity if you would like to learn about cybersecurity or want to build a career in this growing field, consider an online cybersecurity course from Emeritus and make a headstart.
By Tanish Pradhan
Write to us at content@emeritus.org
