- Smishing uses social engineering and identity theft to steal banking or personal data.
- Prevention is based on not interacting with suspicious links and verifying information through official channels.
- There are specific reporting protocols in place for police authorities and cybersecurity agencies.
I'm sure it's happened to you: you receive a text message out of nowhere alerting you to a problem with a package, an outstanding fine, or an amazing prize. At first, you might be caught off guard and feel an urgency to resolve it, but be careful, because Most of these ads are traps. designed to empty your bank account or steal your identity without you noticing.
These types of cyberattacks, technically known as smishing, play on our psychology and the trust we tend to place in our mobile phones. Unlike email, which we already view with suspicion, SMS messages seem more personal, and that's precisely where criminals exploit this. They attack when our guard is down. to make us commit a fatal error.
What exactly is smishing?
Smishing is basically a variant of phishing, but carried out via text messaging. Criminals use the social engineeringThis is nothing more than manipulating human emotions like fear, greed, or curiosity to make us do what they want. They don't need to be computer geniuses; they just need you to hand over your information.
To achieve their goals, they usually resort to two main methods. On the one hand, the use of malicious websites that perfectly mimic your bank's or a transport company's website. On the other hand, the installation of malware on the devicewhere a link takes you to download malicious APKs which, disguised as something useful, spies on your movements and steals your financial keys.
Most common tactics and deceptions
Scammers are very creative and are always updating their scripts. Some of the most common methods you should watch out for are:
- Banking and financial fraud: They write to you pretending to be your bank, alerting you to a suspicious transaction or the blocking of your card, in order to make you panic and click on a fraudulent link.
- Messaging problems: They take advantage of the fact that we buy a lot online to say that your package from Correos, FedEx or UPS has an error in the address and requires you to pay a small fee.
- Fantastic prizes and gifts: You receive news that you have won a prize draw or a technological gadget, but to claim it they ask you personal and banking data.
- Impersonation of public bodies: Fake messages from the Tax Office or Social Security that threaten you with fines or promise tax refunds to scare you.
- The wrong number trick: Someone sends you a "Hello" or a confusing message pretending they have the wrong number to start a conversation, gain your trust, and then try to scam you.
- Family emergencies: Messages where someone claims to be an acquaintance in legal trouble or injured, appealing to your generosity to send money quickly.
Warning signs to avoid falling into the trap
Even if the messages seem real, there are always clues that reveal the deception. Check if the text has spelling or grammatical errors It's strange, since they sometimes use automatic translators. It's also very suspicious that they use generic greetings like "Dear Customer" instead of your real name.
Another key point is the sense of urgency. If the message pressures you to act "right now" or "in less than 24 hours"Be immediately suspicious. Also, check the link's URL; sometimes they change a letter (like putting a zero instead of an 'o') to make the domain appear legitimate when it's actually a cloned website.
Steps to follow if you receive a suspicious SMS
If you have doubts about a message, the golden rule is: Do not reply or clickInteracting with the sender, even just to say "STOP," can confirm that your line is active and attract more attacks. If you believe the warning might be legitimate, close the message and contact the company through their [website/phone number/email address]. official website or their customer service phone number to the client you already have saved.
Once the scam has been verified, the best course of action is to delete the message to avoid accidentally clicking the link and proceed to block the sender's numberThis will prevent them from continuing to bother you with the same tactic.
How to report an attempted scam
Reporting these attacks is crucial to preventing further victims. You have several options depending on your location and the channel you use:
- Telephone operator: In some countries you can forward the message to 7726 (SPAM) so that your provider blocks those patterns.
- INCIBE: In Spain, you can contact the National Cybersecurity Institute through its form or by writing to [email protected].
- National Police: The Technological Investigation Brigade (BIT) has the email [email protected] to receive reports and track malicious domains.
- Software tools: If you use Outlook or Teams, use the option to "Report identity theft" to improve security filters.
Protection and recovery measures
To protect your phone, activate the integrated spam filters on Android or iOS and avoid saving your credit card data directly to your phone's memory. One of the strongest defenses is the multi-factor authentication (MFA)Use apps like Google Authenticator instead of relying solely on SMS codes, as the latter can be intercepted.
If you've already fallen into the trap and provided your data, act quickly. Write down all the details of the attack. change passwords Review all your affected accounts and contact your bank to block cards or accounts if necessary. Don't hesitate to inform local authorities if you've lost money or suspect identity theft. Share this information and help other users be alert to scams.