Fake Text Messages (Smishing)
Fake text messages (smishing) are the short-message form of phishing: messages sent in the name of a courier firm, the e-Devlet public services portal, a bank or a mobile operator steer you towards a fake link or towards sharing information. The small screen of a phone and the reflexive trust people place in text messages make the method especially effective.
| In brief | Smishing is a fraud that uses short messages sent in the guise of an institution or an acquaintance to steer you towards fake links and towards sharing information. |
|---|---|
| How it works |
|
| Warning signs |
|
| How to protect yourself |
|
| If it happens to you |
|
The deceptive advantages of a text message
The sender name on a short message can easily be imitated, and a fake message can land in the same conversation thread as an institution's genuine messages. On a small screen it is hard to see a link address in full, and people read a text message with less suspicion than an email. When these three factors come together, the text version of a trap can reach a higher tap rate than the email version.
Common scenarios
The themes seen most often in Turkey are an 'address update' for a parcel that could not be delivered, an unexpected 'refund or payment', a 'bill discount' in an operator's name, an 'application approval' in the name of a public body, and messages pretending to come from a family member: 'my phone is broken, write to me on this number'. The common thread never changes: you are asked to tap a link, or to send information or money.
Even while you are expecting a parcel
Because these messages are sent out at random and in bulk, they sometimes land on a day when you really are waiting for a delivery; that coincidence is what makes the message convincing. The safe way of checking is always the same: open the courier firm's own application or site and look up your tracking number there. The link in the message never takes the place of that route; for the wider picture you can look at the Phishing record.
Related terms: Phishing, Malware, Account Takeover