Phishing is like fishing in that it uses bait or a lure to make a catch. Phishing, however, refers to baiting a person — often, but not always, through an email — to reveal important personal information that could help the phishing scammer gain access to accounts or money or steal the target’s identity. SMiShing, or smishing, is short for SMS phishing, that is, phishing using SMS messages. The term was coined on 25 August 2006 by David Rayhawk and first used on the McAfee® Avert® Labs blog.
Whereas the goal of phishing is often to have the target divulge valuable personal information — such as credit card numbers, bank account numbers, or usernames and passwords — after clicking some kind of link, SMiShing may either request a response or take a different approach that involves a download. In this case, the target is tricked into downloading a virus or malware, such as a Trojan horse, onto his or her mobile phone.
SMiShing threats have worked in a variety of ways. An early one came as a confirmation SMS message for a dating service, telling the target that he or she would be charged unless a link was clicked to cancel. The URL contained a prompt to download a program containing a Trojan horse, which would turn the cell phone into a zombie, allowing the scammer to take control of it and possibly use it for distributed denial-of-service (DDoS) attacks. Alternatively, the SMiShing scame might allow the download of spyware that would allow the scammer to eavesdrop on conversations held on the phone.
Anti-virus software and anti-malware software are useful in helping prevent SMiShing attacks. Avoiding clicking on suspicious text messages is another useful strategy. When in doubt, emails that threaten account closure or denied access, or charges unless action is taken should be confirmed via a phone call rather than by responding to the message itself. It is particularly important not to use any number given in the message itself, but to independently find the number, for example, on a bank card or credit card, in the phone book, or some other tamper-proof way.
Some financial institutions make a point of alerting customers to the styles of attacks that have been reported, so customers can check to see if this service is available. Also, customers can report suspicious messages to the apparent source — but in a fresh email, not by clicking ‘Reply’ — and to their Internet Service Provider (ISP), to help prevent the spread of SMiShing.
