What is smishing?

Smishing? No, it's not a typo that slipped in. Smishing is a variant of cybercrime that resembles phishing. Smishing has existed since the nineties, and yet few people have heard this term. In this blog we tell you more about smishing and how you or your colleagues can recognize it!

This is smishing

Unlike phishing as we know it via email, smishing takes place via SMS. It is a form of social engineering in which messages with misleading text are sent to victims to, for example, get them to share valuable information, install malware, or transfer money. Smishing is enormously popular, and one statistic explains why cybercriminals engage in smishing. 98% of text messages are read and 45% are replied to. For email this is 20% and 6%, and in addition, spam filters also play a major role here.

How does smishing work?

Besides mimicking the identity of legitimate companies and organizations, smishing messages are also becoming increasingly personal. Cybercriminals use information they can find online for this, such as your name, address, phone number, and the like. Gathering this kind of information is called OSINT (Open Source Intelligence).

Because of these techniques, it's even harder for us as potential victims to recognize smishing messages. For example, if you receive a message from a bank saying your account is blocked, and the message contains your name and account number, it's tempting to click the link in the text message.

Reducing the chance of becoming a cyber victim?

Detecting and recognizing cybercrime can be done using so-called ''red flags''. If you know certain red flags, and can then also identify them, you'll quickly know enough to recognize that it's a fraudulent message.

The following characteristics (red flags) are typical of a smishing message:

• The message contains a link to a website.
• There's a form of pressure behind it, they want you to make a hasty decision
• There's an explicit request for personal info or for carrying out a certain transaction
• The message is in a different language and/or contains many spelling errors, this is far from always the case anymore, but it remains a red flag!

So never click on links from a text message / WhatsApp message from an unknown number. These are often malicious, and here too we have some tips for recognizing this. Want to know how a (malicious) URL is structured?

If you need help improving your cybersecurity awareness, get in touch without obligation or read our cybersecurity awareness training page.