Last year, over $330 million in financial losses due to spam texts were reported to the FTC. What’s more, only 29% of those surveyed actually know what smishing is. Instead of being hidden in the shadows, smishing perpetrators are working overtime. So business owners and team members need to be in the know if they want to successfully prevent smishing.
At Trustpair, we block the financial effects of smishing attacks by continuously controlling payments before they’re executed, even if the fraudsters are able to convince your workers. Contact an expert to learn more!
A definition of smishing
Smishing: aka SMS phishing. It’s a type of manipulation via text message where a fraudster impersonates somebody in order to gain the victim’s trust and access sensitive information or money.
Smishing is a form of phishing, which is the wider term for this scam through channels like email, phone calls, or fake websites. Smishing uses the same social engineering tactics as phishing but refers to the channel of SMS only. That means text messages, WhatsApp, or other messaging apps.
If the victim believes the scammer’s impersonation (through convincing social engineering), they might share confidential details with the criminal. This could lead to the likes of identity theft, business fraud, and financial losses, alongside reputational damage caused by the breach of trust.
How does it work?
74% of smishing is targeted towards companies. The threat is so big, that this type of attack caused $86 million in losses to businesses in 2021. But by knowing how it works, your people can spot the signs and prevent the effects.
Here’s a step-by-step guide to how smishing works:
- The perpetrator targets your business by getting hold of your name and phone number
- They text you and pretend to be a known source, such as a supplier or family member
- In the text, the perpetrator might ask for information, or state that something is wrong with the way the business normally operates and they require the victim to perform an action that’s out of the ordinary
- If the victim believes the perpetrator is who they say they are, they will conform to the request and give the information or send the funds requested
In some cases, the perpetrator will do extra research about their victims in an act of spear phishing. This means they’ll know extra details to make the ruse more convincing.
For example, the text might say,
“Hi Monica, Tony here (new number!). Sorry to be contacting you outside of the normal channels but I’ve got an emergency payment request. We signed on with a new supplier last week and completely forgot to pay their first invoice (due yesterday). Would you mind putting it through the system for me now? We can chat about it on Friday when I’m back in the office”.
Here, the fraudster pretends to be Monica’s real boss and knows that Tony only comes into the office on Fridays. Because Monica is one of only two members of staff authorized to make the payment, the fraudsters have done their research to target the right person.
For fraudsters, spear smishing (or spear phishing) takes more effort and time, but the likelihood of success is also greater.
Examples of smishing attacks
Due to widespread targeting, there have many cases of smishing that have cost both individuals and businesses.
Smishing example: fake covid tests
In 2020, fraudsters took advantage of the pandemic to send mass text messages offering covid tests. They contained links to the “Medicare website”, which actually redirected victims to a fake site.
The aim of the scam was to harvest the information of victims and then bill fraudulent medicare charges to people. The texts appeared to be from “Gov” (a common shortened version of the Government) which made them seem legitimate.
What’s worse, is that this scam targeted those requiring the stimulus checks and pretended to be a form of financial aid. Therefore, the perpetrators took advantage of those in desperate need of covid tests and exploited their vulnerabilities with social engineering.
Smishing example: missing parcel scam
The US’ National Cyber Security Centre recently warned consumers about a dangerous smishing scam that is becoming more popular. The text reads,
“DHL: Your parcel is arriving, view tracking here [link]”
When individuals click on the link, they are redirected to the app store for a fake DHL tracking app. Once installed, this app runs in the background and acts as spyware, capturing all of the victim’s passwords and sensitive details.
This is incredibly concerning for both personal and business purposes, as many workplaces now operate on a ‘bring your own device’ policy. It means that individuals can access confidential work systems via their mobile, and may inadvertently compromise the company as well as their personal situation.
How can you prevent and detect smishing?
For a smishing attempt to be successful, it must satisfy the requirements of the fraud triangle. These three factors are:
- Pressure: The fraudsters have an incentive to commit fraud and target your company specifically
- Opportunity: There are vulnerabilities available to exploit within your company processes and systems
- Rationalization: The individual can ‘explain away’ the immoral nature of the fraud
However, companies can prevent smishing by blocking any one of these three factors. The biggest difference can be made in the opportunities, as organizations have the power to put in place detection and prevention measures to reduce the opportunities to commit fraud.
Learn all there is to know about payment fraud in our latest fraud report!
Fraud awareness training
Businesses might commit to regular anti-fraud training sessions for staff in order to protect against fraud like smishing. This would increase the knowledge around smishing techniques, and ensure employees knew the red flags of fraud to watch out for. The aim of fraud awareness training is to reduce susceptibility.
Identity verification
Alternatively, identity verification methods are a good form of smishing prevention and due diligence. For example, googling the phone number could make it obvious whether the number is associated with scams. If the fraudster is impersonating a company, calling the company directly could help verify whether the text sender is genuine and legitimate.
Ignore links
Finally, avoid clicking on any links within messages from unrecognized numbers. Some smishing attempts involve malicious links, which when clicked on, can download malware onto the device for remote control. Or, it can redirect the victim to a false site, capturing personal details for identity theft or another form of fraud. By ignoring links from unverified sources, your people can protect themselves and the business against smishing.
How should you react if your business is a victim of smishing?
Once the realization sets in that you’ve fallen victim to smishing, it can be easy to panic. But a good response can limit the success of the fraudster, and restrict the effects on your business.
Only a small portion of businesses get their money back after a phishing attempt. Of course, informing the authorities is the best way to do this, but implementing failsafe measures now would mean that nothing is lost at all.
Trustpair’s finance automation features can protect your business’s financial state, even if smishing fraudsters are successful. By automating supplier bank account validation, we verify payee details in real-time to ensure that recipients are genuine, and are who they say they are. So even if an employee falls victim to smishing, we instantly block the suspicious payment and defend the company from any perpetrator.
With 100% success against fraud attempts, why not book your demo for Trustpair?
To recap:
Smishing refers to SMS phishing, an attempt at a data breach through mobile phones and text messaging. Success for the sender means that accounts can be compromised, hackers can steal information for identity theft, and if the victim clicks on bogus attachments, they might download viruses onto their device. Prevent the effects of smishing with Trustpair’s automatic financial monitoring platform.
