SMS phishing is a situation when a cell phone receives a SMS (Instant Message or IM) from a fake person or entity. The unsuspecting cell phone user will respond to a fake SMS and visit a URL, inadvertently downloading malware and installing a Trojan without the user’s knowledge. Phishing is all about extracting useful information, so in the case of SMS phishing, the Trojan harvests the data areas of the cellphone and transmits them to the person who created the Trojan at the earliest opportunity.
It is a way of performing identity theft, as the inadvertently downloaded malware captures and transmits all of the stored cellphone data, including stored credit card details, names, addresses and other data, like password details for email accounts, which, when opened, increase the vulnerability of online banking and other accounts.
The malware can then cover its tracks by wiping the phone clean, including all call records, causing repeated rebooting or similar odd behavior rendering the phone unusable. Thus, the original phishing attack is easily unnoticed by the user.
Viruses and phishing scams are far reaching to all types of digital devices. Wise consumers should choose their products according to available product security software and data recovery technologies.
TO GUIDE AGAINST SMS PHISHING DO THE FOLLOWING
RULE 1: Don’t respond to SMS calls to action
First, and the biggest warning flag, is that it had a call to action. It suggested you click a link. Others ask you to call or text a number. Some just want you to reply. It doesn’t matter what the actual action is. When you see a call to action in a text, immediately begin to consider that it could be fraudulent.
Executive guide
Don’t click on that email! Find everything you need to know in this phishing guide including how to protect yourself from one of the most common forms of cyber attack.
This is not a black and white situation. At the moment I’m writing this, my Instacart shopper is on the way with my grocery delivery, and Instacart sent me another text. It gave me a link to its app and a another link to its website so I can check the status of the driver on the road.
Even though I know (or at least, am pretty sure) that the text from Instacart is valid, I’m not going to click on a link. As a matter of practice, I never ever click on links in text messages. Most services (whether FedEx or Instacart or Uber) allow for web-based tracking, so if I want to know the status of my order, I’ll log into my account on the web and check it from there. That’s because I also don’t know if the gig worker’s phone itself might have been compromised.
RULE 2: Pay attention to anything that’s out of character
The fraudulent FedEx smishing attempt I showed you above begins with “Hello mate.” Although I have a number of Australian business colleagues that greet me in that exact same way, it’s highly unlikely that an official communication from an American company to an American customer would begin with “Hello mate.”
It’s out of character. Many phishing and smishing attempts can be spotted by these sorts of out of character or even blatant grammatical mistakes. Whenever you see something that’s even slightly not right or slightly inappropriate for the circumstances, be wary.
RULE 3: Pay attention to the details of the call to action
In my case, the call to action asks me to click on a URL beginning in d5ncr.info. That’s almost definitely not a FedEx-related domain. Even if I was a current customer of, and got a message from, the 140-year-old NCR Corporation (which used to be AT&T Global Information Solutions and before that National Cash Register), I still wouldn’t click d5ncr.info.
I told you in Rule 1 not to respond to SMS calls to action. This rule is similar. This time, however, you’re spending a few extra minutes analyzing whether the message is giving off signals that it’s probably fraudulent.
RULE 4: Do your due diligence via legitimate channels
Even though the message contained an out of character greeting and an unlikely-to-be-legit URL, what if it’s real? What if an all-important package I’m actually expecting is blocked because I didn’t respond to this message?
That’s a legitimate question, especially since phishing and smishing scams are designed to prey on that “what if” fear. What if that notice from the IRS is real and you don’t respond? What if the FBI really is investigating your neighbor and some kind of terrorist activity took place because you chose not to help? What if your PC could be oh-so-much faster if you only installed this free utility?
This is the essence of social engineering. Scammers use tricks designed to get under your skin, trigger your fears or concerns, and induce you to let your guard down for just the fraction of a second it takes for your finger to twitch and tap the screen.
Viktor Frankl, noted author of man’s search for meaning said, “Between stimulus and response there is a space. In that space is our power to choose our response. In our response lies our growth and our freedom.”
This is deep, so pay attention to it. In the case of fraudulent messages, the message is the stimulus. But you can take a breath, create space, and choose a different response. If you’re truly concerned about whether, for example, GB-6412-GH83 won’t be delivered, go to FedEx’s known site and look it up.
Even if you only have a phone, you can go directly to the company’s site without clicking a link. Use your phone’s browser to visit the known, verifiable home page or call the known, verifiable 800-number of the company or agency you’re concerned about.
RULE 5: Block junk calls and texts
Although the effectiveness of these tricks varies based on carrier and locale, here are two additional tricks you can use to reduce the annoyance. First, I flip the block unknown senders switch on your phone to filter senders with numbers not in your contact book.
You can also use your vendor’s anti-spam service. I use Verizon’s free junk blocker.
Drop your comment below.
