Stay One Step Ahead: Recognizing, Resisting, and Reporting “Smishing”

You’re in a rush; you grab your phone, and there it is — a text message from a familiar company, like your financial institution, asking you to provide personal info or click a link. It may even look like a fraud alert or a message asking you to confirm a charge. But something is off. You didn’t contact the company, and, strangely, they contacted you out of the blue. You have received a “smishing” scam.

“Smishing,” a combination of “SMS” and “Phishing,” is a phishing scam delivered by text message or through popular apps like WhatsApp or Facebook Messenger. Fraudsters pose as a company to trick you into sharing sensitive details like usernames, passwords, or banking information. They can also try to steal your Social Security number, birth date, or other ID numbers. 

Sometimes, the text message asks for the information directly; other times it asks you to click a link, often to “verify” your information. Once you provide the information, you open the door for an attack.

What do Smishing scams look like?

Scammers are getting better at appearing legitimate, but many common scams look like one of these situations:

Scenario 1: Phishing Text

• You get a text or phone call reporting fraud on your account or referencing other high-stakes scenarios that make a situation seem urgent.
• The fraudster asks for your username, password, one-time codes, PIN, account details, or even recent account transactions. Their goal is to make you act before you think.
• The fraudster may suggest that sharing this information will help remediate the situation quickly. They are really using it to access your account and steal your hard-earned money.

‍

How to protect yourself

Never share your username, password, codes, or account information with anyone who contacts you — even if they say they’re from a trusted entity, like Trax Credit Union. Instead, contact the company directly using a known number or secure channel, such as Digital Banking. Don’t call them back on the number they provided — visit the company’s website or business listing to find a safe number.

Trax Credit Union will never ask you for your personal login credentials. Sharing this information — even with one of our trusted employees — undermines the security measures we’ve put in place to protect you from fraud.

Scenario 2: Phishing Website Links

• You receive a text with a link. The link doesn’t go to the company’s real website, but to a duplicate website intended to trick you into entering your credentials as if you were logging into your account.
• The website seems normal, so you log in. 
• The fraudster steals your information and uses it to access your account.

‍

How to protect yourself 

Don’t click on log-in links sent to you via text message. Instead, log in using your usual method, either by visiting the site directly or via your trusted mobile app.

Enable multi-factor authentication (MFA). If you have MFA enabled and aren’t prompted to authenticate, the site may not be legit.

Check the URL and login page. Does the page look right? If the URL is misspelled or different, close the window immediately. 

Scenario 3: Malware Links

While a Smishing message often links to a false website, some links contain malicious apps and code that download to your device. Sometimes this occurs without your knowledge. These apps and code are designed to collect sensitive information from your device.

How to protect yourself 

Do not click links from unexpected texts and emails. If you do, close the browser and run malware software immediately. Never download apps from links unless you requested them first. 

Smishing can lead to identity theft and financial loss. The best defense against scammers is recognizing red flags, resisting scam attempts, and reporting suspicious activity mediately. 

We advise you to be aware of the following red flags:

• Messages from suspicious or unknown numbers
• Unusual message formatting
• Pressure or a heightened sense of urgency
• Requests for money
• Reward notifications
• Any message where someone contacts you and asks for sensitive information

‍

We always recommend keeping your device’s operating system up to date to benefit from the latest security features. Don’t be afraid to use your messaging app’s “report junk” option to alert your wireless carrier. 

If you fall victim to fraud, contact Trax Credit Union at 813-800-8729 and other affected service providers as soon as possible — we can often assist with identity theft and fraud resolution services.