Tech & Innovation in Healthcare

Question: I overheard one of my colleagues talking about receiving a smishing text message on their phone. What is smishing and is it different from phishing?

South Dakota Subscriber

Answer: Smishing is a social engineering cybersecurity attack that is very similar to phishing. A smishing attack happens when the threat actor sends a deceptive text message in hopes of tricking the recipient. The term combines “SMS” and “phishing.” SMS stands for Short Message Service, also known as text messages.

The scammer sends the text message pretending to be an actual business. Typically, the text message received will portray an urgent situation that requires attention and issues threats if action isn’t taken immediately. If the recipient opens the message or taps on an included link, the smishing attack can load malware onto the device or direct the victim to a fake website that looks like the legitimate organization’s website.

For example, during the height of the COVID-19 public health emergency, threat actors would pose as government officials offering free COVID tests and other services. If the victims clicked on the links attached in the text message, the scammers stole personal identifiable information, such as Social Security numbers, to commit identity theft.

Smishing continues to grow in popularity with cybercriminals. One factor behind the attack’s growth is that hackers know that victims are more likely to click on links in text messages than email since consumers are used to receiving text messages from banks, retail companies, and social networks. At the same time, more people are using their personal mobile phones for work due to bring-your-own-device (BYOD) policies and remote work. Cybercriminals can exploit the employees’ personal devices to breach company networks.

You can help protect yourself and your staff from smishing scams. Smartphone operating systems can automatically route suspicious text messages to a spam folder. The operating systems can also block unapproved apps from loading onto the devices. If your organization allows BYOD arrangements, you can consider employing unified endpoint management (UEM) security solutions for mobile device security and policies.

Another way to protect your organization is through education. Train your staff to identify cyber attack warning signs and smishing attempts. Being extra cautious around cybersecurity and suspicious activity is always a good thing.