Hello! Cybercriminals are always focused on trying to get money from their victims. With this in mind, they use any kind of method to scam and steal money from them. One of the most used methods is to steal our credentials for different online accounts, bank login and password and even credit card theft. To accomplish this, they use phishing. In fact, This attack arrives by e-mail and induces the victim to click on a link. This link then leads to a website specifically designed to look like a legitimate website of a bank or any other service. It is at this point that the victim suffers the fraud. However, this is not the only large-scale attack out there. Therefore, today we are going to talk about one of the most dangerous ones, which is Smishing.
What is Smishing
Smishing is a very dangerous variant of the typical Phishing attacks that reach us by e-mail. Although the form of attack changes regarding Phishing, the objective is the same. The aim is to deceive the victim in an attempt to steal his or her login credentials, bank accounts and even debit or credit cards. This is done by making the victim believe that they are on an official and legitimate website. Our security and privacy is at risk from this type of attack. We could certainly leave our passwords exposed, including any bank accounts we may have, so we must be meticulous with this type of attack.
Smishing uses SMS messages that we receive on our cell phones with a link. This SMS message “appears” to be from our bank. However, cybercriminals change the origin of these SMSes so that the victim trusts that he has received an SMS from BOFA, Wells Fargo, Citi or any other bank.
How it’s work?
You will receive this SMS whether you are a customer of this particular bank. In other words, if we have an account with Wells Fargo, we can perfectly receive an SMS pretending to be from Citi. When we receive an SMS from a bank where we do not have an account, we usually delete it. However, if it just so happens that you do have that bank, then you could trust the SMS you receive. Consequently, clicking on the link can lead to fraud.
Nowadays, this type of attack is aimed at stealing bank accounts or credit cards. Therefore, we must pay close attention to the SMS we receive from our bank. It is certainly critical not to click on any link in the SMS to avoid this phishing attack on the bank. What we want is to avoid that we are the victims of identity theft. Next we will see how smishing behaves.
How to detect this attack and avoid it
This phishing attack aims to steal our credentials. However, it can be easily and quickly detected. On the other hand, this depends on what kind of SMS we receive and how the hook message is constructed to make users fall for the scam.
The first thing to look at is the spelling of the SMS. In fact, this type of attack is usually carried out by cybercriminals who are in other countries and do not know the spelling of English. We should also look at the way they address us. This is easy to check by comparing it with legitimate SMS from our bank. In the end, the result is typically different.
The second thing to look at is whether they encourage you to click on the link. That is, they are looking for the user’s fear and inform us that something is wrong or that there has been an excessive charge in the bank account, and invite us to review it. It is possible that if we click on it, they may ask us for personal information. This information will later be used against us maliciously. Another aspect you should check is whether there is a hurry for you to click on the link yourself, i.e., it is something very urgent that cannot wait. This way we can easily detect if an SMS is smishing.
Please use common sense
We should also check if the SMS has a link to the bank’s website. In fact, you should never access your bank through a link you have received by SMS. To avoid problems, access directly through the app on your cell phone or from the official website that you have saved in your computer’s bookmarks. This way, you will be able to access your bank account safely and without fear. If you click on the link, you may be taken to a website that is specifically designed to deceive you. That is, it is the same as the official one but will be used to steal your login and password. Consequently, you should never enter your credentials on such a website.
A few years ago, illegitimate scam websites used the HTTP protocol for their scams. This protocol does not offer any kind of point-to-point encryption, so it was the first aspect you should check to see whether it was a legitimate website or not.
Consequently, if the user does not see the padlock, then he/she is already suspicious. Nowadays, scam websites also work with HTTPS. However, this means that the communications are encrypted with the scam website, it does not mean that the website is secure and legitimate. Therefore, although this website uses HTTPS, it could very well be a fake of the legitimate website.
What should we do
What you should do if you receive an illegitimate SMS is to delete it as soon as you receive it. In addition, you should never click on the link or link that we have in the SMS. This way, you will not be a victim of this type of attack. Finally, we must use common sense. In fact, the bank will never ask us for data that they already have, such as our username and password, nor the data of the debit or credit card. If you receive an SMS that urges you to hurry, you should know that your bank will never contact you by SMS for important matters, but will call you directly.
What to do if we have already been victimized
What you should know is that if you have not clicked on the link you are not in danger, you simply need to delete the SMS and not click on it unintentionally. It is significant that you delete this SMS as soon as possible to avoid entering the link accidentally.
If you have clicked on the link, there are some SMSes that take you to a fraudulent bank website and invite you to fill in your username and password. If you have not filled in anything on this website, simply exit this fraudulent website and delete the SMS you have received. In case you have filled on the website with personal data, you should do the following:
- Review what data we have provided and what they can do with it.
- If you have entered your bank username and password, log in as soon as possible through the app or via the web and change the password. You can also call your bank manager directly to inform him/her of the issue. In consequence, he/she can be alert in case you have suffered an intrusion in your account.
- If you have entered your credit or debit card, block it as soon as possible. Even if no charge has occurred yet.
What to do if you download a malicious app from a link
In case you click on the link, you should never install an application because it could be a banking Trojan to steal all our bank accounts. So, what you should do is delete the downloaded application or program. In the same way, you have to delete the downloaded application or program, exit the fraudulent website and also delete the SMS message you have received. If you have installed the fraudulent application, you should quickly do the following:
- Delete the app as soon as possible.
- Download an antivirus for your smartphone. Start scanning as soon as possible to remove any malware that may have been installed.
- Change the passwords of all the accounts you manage with your smartphone, including those of your bank.
However, the best thing to do is to restore it to factory defaults to make 100% sure that no trace of the malware remains. In this way we have seen what smishing is and how we can protect ourselves. Bye
