What is Smishing?

The increased use of smartphones across the globe (5.48 billion as of October 2022) has changed the way people used to communicate. But this also brings cybercriminals close to you. There are different ways cybercriminals can use social engineering attacks and phishing attempts to take login credentials and personal details. One of the popular techniques is smishing. Let us now understand what is smishing in cybersecurity.

Smishing is a portmanteau of two words SMS + phishing. It is a type of phishing attack wherein the attacker sends compelling text messages to a target user. They trick the targeted recipients into clicking a link or other content over that message. It can lead the attacker to steal private information, download malicious programs, or redirect you to an illegitimate web page. The increased use of BYOD and smartphones for business lures cybercriminals to perform smishing attacks. Smishing has thus become an enterprise-level threat for many organizations. Without proper security measures and policies, an enterprise can face losses in millions, if not billions.

Since we have gathered a fair idea of what is smishing in cybersecurity, we will dig deep into its working.

How does Smishing Attack Work?

Since we have gathered a fair idea of what is phishing, let us explore how attackers make it work. Most smishing attack works like phishing only. Since the use of mobile phones has dramatically increased, attackers try to send a message enticing the user to click a link or ask for a reply that can steal the targeted user's private data. However, this is not the only way to steal user data through phishing. Since smartphones have internal linkage with multiple communication channels and apps like email, social media, etc., attackers benefit in different ways by targeting these smartphones.

In a smishing attack technique, the attacker will send an SMS to the target. The attacker will masquerade as a legitimate user & will show some urgency or exciting offer to entice the victim into clicking it. As soon as the victim clicks the link from the message, it will redirect the link to a page (maybe Gmail or Facebook). The page will look legitimate. But, it is a smishing page created by attackers to steal the login credentials. As soon as the victim provides the login ID & password, the attacker gets those credentials & the victim will see a page refresh.

Smishing attacks become beneficial for attackers because, with the increase in the number of smartphone users, brands promote their business through SMSs. Also, the increased use of smartphone messages helps attackers easily target a wide range of people who are not aware of such scams. COVID-19 urgent reports, account issues, frequent amount deducting SMSs, order confirmation, 99% discount coupons, etc., are some message subjects that tempt the victim into opening them and clicking their links. Let us explore these smishing message examples and the way attackers frame the attack.

Examples of Smishing Attack

Smishing is a modern form of attack and uses a different pretexting trick. It makes the recipient click on the embedded link within the message. Here are some common examples of what smishing attacks appear.

1. E-commerce discount messages:
   We often receive SMSs and social media inbox messages about offers, discounts, and coupons code. Through these deceptive and persuasive messages, they want to trick you into clicking the link that will either download malware into the system without you noticing it or redirect you to a phishing page.
2. Mandatory COVID-19 test scams:
   In April 2020, there were multiple reports about attackers using smishing techniques to impersonate government officials in text messages. They were asking people to take mandatory COVID-19 tests & register through certain links (that were malicious). Now, the attackers mentioned that they have initiated the testing through online links. That way, they used to steal sensitive information from target users.
3. Order confirmation messages:
   We all know we order food, clothes, and other items online through our smartphones. Attackers do thorough research on the target to identify what apps and services the target is using through their smartphones. Then based on their orders, they will send a deceitful order confirmation message with a link to modify or cancel the order. As soon as the victim clicks the link, it redirects to a phishing page to enter the login ID and password. That is how attackers get to know about the victim's login credentials.

Types of Smishing Attacks

There are different types of smishing attacks possible. Some play with your mind by generating stressful situations, while some will excite you to tap a link that might download malware. Here are some types of smishing that are popular these days.

• Generate a sense of urgency (bank/credit card):
  Attackers often use the name of financial institutions as a context for smishing. Attackers will create a persuasive message notifying you about an interruption of funds or unpaid bills. It will create a stressful situation with an urgent matter.
• Masquerading technique through fake link tactics:
  Attackers often send fake SMSs but pretend to symbolize a legitimate company or organization. They will provide a link similar to the one provided by a legitimate company. Attackers might also use a URL shortener to conceal the organization's name. Through those SMSs or counterfeit links, the attacker will ask the victim to take action, such as entering personal details, verifying the password, delivering the address, etc.
• Drive by download (malware attacks):
  In this type of attack, the attacker will include a sophisticated link. As the victim clicks that link, the link will download malware into the victim's smartphone. Through such techniques, attackers can take remote access to victims' smartphones.
• Password reset scam:
  It is another scam-based smishing technique where the attacker will first extract details about the victim's phone number and email ID. Then the victim will send an SMS masquerading as a legitimate sender to the victim, claiming that their account has experienced a breach. They also provide a hypertext "Forget Password Link", in which they attach a fake phishing page link.
• CEO fraud:
  Every employee wants to impress their superiors, especially when that senior is the company's CEO. If the company's CEO sends a text message, every employee considers the work a priority. Attackers use this consideration to target corporate employees. They will identify the CEO's phone number or email ID. They will then send a spoof message to the target employee mentioning - "I am the CEO who is messaging you for this urgent task". Such an SMS will also contain a link the victim will click and log in. That way, attackers can gain access to corporate employee accounts.

How to Protect from Smishing Attacks?

Different cyber hygiene & best practices one can follow to prevent smishing attacks. Some of them are:

• Every individual should leverage multi-factor authentication in their accounts so that even if the attacker compromises the login credentials, they will not be able to bypass the second authentication factor (OTPs or biometric scans).
• Employees and individuals must remain vigilant about whether SMS, social media message, or any other mobile notification comes from a legitimate source or someone they don't know.
• Businesses must make BYOD policies so that only trusted smartphones get used. Also, the policy should mention how to maintain cyber hygiene while dealing with corporate work through personal smartphones.
• Individuals must make decisions logically & not emotionally while using SMSs & downloading attachments or chatting with strangers.
• It is always a good practice to avoid clicking links from unknown senders. Even if the sender is a known peer, but the message looks suspicious, you must call or meet that employee manually to verify if that person sends the SMS to you.
• Do not provide data to any website or source. Most financial institutions or CEOs will not ask you to provide your login credentials or personal details on any website.
• It is always a good practice to use mobile apps from the app stores only. These apps remain verified by Google & many security researchers also ascertain them.
• Companies should train and educate employees about phishing and smishing attacks. Enterprises must opt for dummy threats and drills so that the IT team, in collaboration with the security team, can guide all employees against such cyber threats.

Smishing vs. Vishing vs. Phishing

Since we have gathered a basic understanding of what is smishing in cybersecurity, let us now understand the difference between smishing, phishing, and vishing.

Learn More

Cybersecurity has become an essential skill in this technology-driven industry. To know more about cybersecurity and the core aspects of cybersecurity, click here.