You Just Won a Car! Claim It Here!

You just won a car! Claim it here! Probably it is not the first time you’ve received this type of SMS on your phone. We probably shouldn’t have to remind you that if you receive something like this, you’d better not open it! Don’t click on any link! IT’S A SCAM! Fly, you fool! Fly! Your financial well-being depends on that. Don’t give away your money so easily to those who try to seize your keys, credentials, and personal information.

Smishing is how this type of scam is called. It represents (along with phishing, vishing, and pharming) $54M in losses just in the United States (as shown in the FBI Internet Crime Report 2020; see Figure 1. Also, click here to know more about what’s in the FBI’s 2020 Report). This is quite frustrating! It is so much money and it is so easy to avoid being victims of this type of scam. To keep criminals from robbing you like this, you must know the modus operandi of such scams. As the famous writer Frank Herbert said: Knowing where the trap is – that’s the first step in evading it.

Let’s start with the name smishing. Since it is a type of scam that occurs through the Short Message Service (SMS) of our mobiles by adapting the phishing scam method, it is known as the blend-word smishing (SMS+phishing). It is a type of cyberattack that tricks victims into sharing valuable information, installing malware, or giving away money (click here for more info). This scam has widely spread in various parts of the world. In March of this year, smishing generated £20-30M losses to the Newham’s (UK) largest banks. Last year, the Bank of Ireland also had to "reimburse a total of about €800K to as many as 300 customers who have fallen victim to a text «smishing» scam.” But how could anyone steal information, money or install a malicious program via a supposedly harmless text message?

Smishing always operates on the same principle: to be a fraudulent message that motivates the victim to provide information or click a link. In this way, we could classify this fraud into three categories:

The first and most important one is do not open any SMS from a number you don’t know. If you think it may be real, make sure to get in touch through official communication channels (bank, health insurance, etc.). Verify the information sent to you, but NEVER CLICK on the link provided!

The second piece of advice is to always keep in mind three aspects related to bank actions:

Lastly: Never think you’re exempt from being a victim! You must be very careful as scammers are increasingly refining their methods. In the scammer world, this type of smishing has become one of the favorites for several reasons. People often receive lots of SPAM in their mail, which causes many of unopened emails. Thus phishing is becoming less and less popular. In comparison, we are less aware of scams via SMS, so we interact more easily. For us, our phones are very personal and reliable, contrary to emails that we are more cautious about. Unlike computers, phones generally do not have firewalls or antiviruses to hinder such scams.

If you want to know more about how to protect yourself from cyberattacks, we invite you to review our page.

At Fluid Attacks we are specialized in cybersecurity through pentesting, ethical hacking and red teaming. For more information, don’t hesitate to contact us!