What is SMiShing?

Mary Elizabeth
Mary Elizabeth

Phishing is like fishing in that it uses bait or a lure to make a catch. Phishing, however, refers to baiting a person — often, but not always, through an email — to reveal important personal information that could help the phishing scammer gain access to accounts or money or steal the target’s identity. SMiShing, or smishing, is short for SMS phishing, that is, phishing using SMS messages. The term was coined on 25 August 2006 by David Rayhawk and first used on the McAfee® Avert® Labs blog.

SMiShing is used to get someone's personal information to steal their identity or account information.
SMiShing is used to get someone's personal information to steal their identity or account information.

Whereas the goal of phishing is often to have the target divulge valuable personal information — such as credit card numbers, bank account numbers, or usernames and passwords — after clicking some kind of link, SMiShing may either request a response or take a different approach that involves a download. In this case, the target is tricked into downloading a virus or malware, such as a Trojan horse, onto his or her mobile phone.

SMiShing often hides a virus or malware in an otherwise innocuous text message.
SMiShing often hides a virus or malware in an otherwise innocuous text message.

SMiShing threats have worked in a variety of ways. An early one came as a confirmation SMS message for a dating service, telling the target that he or she would be charged unless a link was clicked to cancel. The URL contained a prompt to download a program containing a Trojan horse, which would turn the cell phone into a zombie, allowing the scammer to take control of it and possibly use it for distributed denial-of-service (DDoS) attacks. Alternatively, the SMiShing scame might allow the download of spyware that would allow the scammer to eavesdrop on conversations held on the phone.

Anti-virus software and anti-malware software are useful in helping prevent SMiShing attacks. Avoiding clicking on suspicious text messages is another useful strategy. When in doubt, emails that threaten account closure or denied access, or charges unless action is taken should be confirmed via a phone call rather than by responding to the message itself. It is particularly important not to use any number given in the message itself, but to independently find the number, for example, on a bank card or credit card, in the phone book, or some other tamper-proof way.

Some financial institutions make a point of alerting customers to the styles of attacks that have been reported, so customers can check to see if this service is available. Also, customers can report suspicious messages to the apparent source — but in a fresh email, not by clicking ‘Reply’ — and to their Internet Service Provider (ISP), to help prevent the spread of SMiShing.

Individuals should avoid clicking on suspicious tect messages in order to prevent SMishing attacks.
Individuals should avoid clicking on suspicious tect messages in order to prevent SMishing attacks.
Mary Elizabeth
Mary Elizabeth

Mary Elizabeth is passionate about reading, writing, and research, and has a penchant for correcting misinformation on the Internet. In addition to contributing articles to wiseGEEK about art, literature, and music, Mary Elizabeth is a teacher, composer, and author. She has a B.A. from the University of Chicago’s writing program and an M.A. from the University of Vermont, and she has written books, study guides, and teacher materials on language and literature, as well as music composition content for Sibelius Software.

You might also Like

Readers Also Love

Discussion Comments

anon333132

How do we know the phone in the picture is receiving a smishing attack, not just a harmless text?

Post your comments
Login:
Forgot password?
Register: