Smishing (SMS Phishing) Attacks are Increasing

Phishy Text Messages

[not2easy]

Since phishing isn't quite as successful as it once was, it appears that smishing (SMS phishing) is trying its hand and finding easier marks. Just a heads-up to be aware of the scam so it doesn't catch you off guard.

The US Internal Revenue Service is warning taxpayers of the dangers: [irs.gov...]

So far in 2022, the IRS has identified and reported thousands of fraudulent domains tied to multiple MMS/SMS/text scams (known as smishing) targeting taxpayers. In recent months, and especially in the last few weeks, IRS-themed smishing has increased exponentially.

Smishing campaigns target mobile phone users, and the scam messages often look like they're coming from the IRS, offering lures like fake COVID relief, tax credits or help setting up an IRS online account.

Business related attacks are also increasing, as reported in this (possible paywall) Washington Post article: [washingtonpost.com...]
That article says the technique has claimed victims at Twilio and was also aimed at Cloudflare. The effort

combines text messages intent on luring victims into clicking on a link, leans on the ubiquity of smartphones, seeks to manipulate human nature, and works around an increasingly common defensive measure.

The link leads to a fake Okta site or another tool that verifies a sign-in, known as multifactor authentication or MFA.

[engine]

So much info can be extracted from those falling for that particular scam.

Yes, it's been a "thing" for a while here, and the scams are usually related to something in the news, which means people are receptive. The latest offer rebates from the Government, but, of course there is no rebate from the scammers.
Parcel delivery smishing is another big one.
It's reached the stage where i'm sceptical of every sms.

[Sgt_Kickaxe]

I pay for an online service that I need for work. The service requires I provide a mobile number to respond to frequent security verifications. I knew in advance that this service has a history of selling data so I set up a cheap flip device I never use for anything else.

DAILY I get automated calls, SMS messages and links for various reasons including this new smishing method. I never answer or respond but it doesn't stop.

Anyway, a tip. When you set up a 2nd mobile phone for "business" it really helps if you make a typo in your name, or use your middle name. The SMS messages often know the name associated with the phone but your friends and family don't call you by that name, or make the typo. If you see the typo it's not from someone who knows you, let them leave a message and click nothing.

Example: If your name is Mike, give your name as Mikke at signup. When you see "Hello Mikke, this is the IRS" you can hang up and not waste a moment worrying about it.

[ronin]

It's concerning how many recently-evolved communication channels we have, that have so quickly been compromised - sometimes terminally.

Twitter, I started using in 2008 and stopped using in 2016.

Facebook, I started using in 2007 and stopped using in 2019.

Email I started using in 1994, but after reducing email usage for a number of years after 2008 I made an explicit decision to stop using email in 2018. (Inevitably I need to use it as a reference occasionally - for e-tickets etc. - but I no longer communicate via email.)

I started using SMS in 2000. I've never made an explicit decision to stop using SMS, but since for a number of years now I've been messaging via WhatsApp (mostly), FB Messenger (sometimes) and Signal (occasionally), I kind of... don't use SMS anymore either.

I know a lot of people will continue to use some or all of these channels - but I can't be the only individual who has thrown in the towel on some of these communication channels and decided that life is generally better without.

When we think of the telegram and the telephone, not to mention the written letter, that feels to me like a lot of communication channels to have come and gone in the last quarter century.

[tangor]

For phishing or smishing to work the end user is the weak spot. Sadly, there's not enough education for the end user out there these days.

Email remains my communication method (and for legal reasons as well), never bothered with sms or twitter, fb I ditched years ago, even when I was an early adopter.

The bad actors will continue to intrude in whatever METHOD is in use. When one form loses in hits they will move to the next "popular" method to continue their "business."