What is Smishing? A Guide to SMS Phishing Attacks

Learn to understand, detect and prevent Smishing Attacks.

SMS phishing attacks or “smishing” are becoming more and more common. The more you understand about smishing attacks, what they’re capable of and what the potential risks are, the easier it will be to identify and prevent damage from one.

In this simple guide, we’ll show you what smishing is, how to detect it and how to avoid being the victim of a smishing attack.

What Does Smishing Mean?

Smishing (aka SMS Phishing) is when an attacker sends a fake message to your SMS number, often containing an offer for a free product or an urgent alert regarding banking or other sensitive information.

Smishing is particularly dangerous for those that don’t have an understanding of basic cybersecurity, because the SMS messages are worded in a way that they’re believable. Some smishing messages even include vaguely personal information to sell the narrative.

How Do Smishing Attacks Work?

Smishing attacks are considered social engineering attacks because they prey on people through psychological manipulation. In most cases, the smishing message is designed to create a sense of urgency. Messages can include trigger phrases or words like “act now” and “your account is at risk if you don’t click here” or “there will be legal action taken against you if you don’t follow up.” These messages can inspire fear and eventually action.

Cybercriminals get phone numbers via data breaches on the web. When you sign up for a web account on a retail site, for instance, you’re often giving out your email, phone number and other personal information. When cybercriminals break into retail web records, those records are often distributed or sold on the dark web for profit. Thus, your personal information is distributed abroad.

You also may have entered your phone number via a phishing email or on some other illegitimate site and the company behind the site was actually a cybercriminal.

Cybercriminals often extort victims of smishing attacks for more personal information or even money, in some cases. IRS scams are common and victims often wire thousands of dollars to cybercriminals under the belief that the IRS will prosecute them if they don’t.

Smishing vs. Vishing

Smishing and vishing are both similar in that they require the use of a telephone to function, but vishing uses voice services instead of SMS messages. Vishing can sometimes be more effective because you’re actually talking to a person on the other end of the phone. The tone of a conversation can potentially drastically affect the outcome. If you think you’re going to be persecuted if you don’t respond, you’re more likely to give up the information your attacker is looking for.

How to Detect Smishing Attacks

Smishing attacks are common and there are some signs to look out for.

“Congrats! You’ve won!” This is a common smishing message that makes the victim believe they’ve won a monetary prize. The link or phone number attached will usually ask for personal information first. If you didn’t participate in a contest, you likely didn’t win anything.
Text sent at an unusual time. Most businesses operate somewhere between 8 am and 6 pm, so if you’re receiving messages from a “legitimate” organization late at night or very early in the morning, take notice.
Urgent banking message. Chances are, your bank will personally call you with any urgent requests or errors. In this case, the bank will normally verify your information over the phone as well. If you receive an urgent banking message via SMS, call your bank to verify it first.

Spelling and grammatical errors. Legitimate organizations hire editors and experienced writers. Check your SMS for spelling or grammatical errors to identify a scam.
Use a VPN. VPNs are legitimate services that allow you to mask your IP address and keep unfriendly eyes from seeing your true location and web activity, even on your phone. This can help you identify smishing messages, particularly if you receive one that references an incorrect location which is being spoofed by your VPN. However, some cybercriminals have even taken advantage of the demand for VPNs and send “free” or “discount” offers for VPN services via SMS.

How to Prevent Being a Victim of Smishing

Use a password manager like Keeper to store and manage passwords for all of your accounts safely. Always enable 2FA or MFA protection to prevent unauthorized access.
Never call the phone number associated with a potentially spoofed message. If it’s from your “bank” call your saved bank number to verify.