Don’t Get Smished!

Victims got wise to email and phone tricks, so fraudsters turned to text messages.

What it is: Smishing is a type of fraud where scammers use SMS (text messages) to trick people into revealing personal information or downloading malicious software.

How it works: Hackers may choose targets randomly or find their victims based on data they get from past security breaches or the dark web.

The smishing expedition starts when the hacker sends a text message with a false claim, threat, or offer. If you answer, they’ll try to keep you engaged and use technological manipulation or psychological tactics to persuade you to download malware, share sensitive information, or send money. 

Warning signs

Watch out for these signs:

• A message from someone not familiar to you
• A sense of urgency in the message
• Poor grammar
• Links or files attached to a text
• A request for you to share sensitive information or a verification code

Protect yourself

Just opening a text message, even a suspicious one, won’t compromise your data or infect your phone. The danger lies in your response to the message. Always be skeptical! Following are some actions you can take to protect yourself:

• If you receive a suspicious text, don’t respond or click a link. Instead, just ignore the text. If the sender claims to be from an organization you know, you can contact them separately through a verified phone number. If you need to visit a website, verify the URL and type it directly into your browser.

• Slow down. Even if the person trying to reach you has a legitimate purpose, waiting a few hours and consulting a trusted friend or loved one won’t keep you from properly handling the situation (and could keep you safe from falling for a scam).

• Install phone updates regularly. Security updates often include protections against the latest threats, so make sure your device’s operating system and applications are up to date.

• To protect sensitive personal information (such as bank accounts, health records, social media accounts, etc.), set up multifactor authentication (MFA) to lock down access. Do not share this code with anyone; Harborstone team members will never ask for an MFA code.

Read more in this article on the Federal Trade Commission website: Avoid the Temptation of Smishing Scams.