What is smishing? Meaning explained as reports of text message scams rise - and how it differs from phishing

Reports of ’smishing’ scams are on the rise.

This comes after Which? said in September last year that figures from Proofpoint show reports of smishing in the UK increased by nearly 700% in the first six months of 2021, compared to the second half of 2020.

But what is ‘smishing’ and what are the scam signs to look out for?

Here’s what you need to know.

What is smishing?

Phishing is the fraudulent practice of sending emails pretending to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Advertisement

‘Smishing’ is SMS phishing scams, which instead involve texts often pretending to be from banks, delivery companies and phone networks.

Which? said figures from Proofpoint show reports of smishing in the UK increased by nearly 700% in the first six months of 2021, compared to the second half of 2020.

This was driven by scammers looking to take advantage of Covid pandemic-related shopping trends, such as people getting more deliveries to their homes and the increase in businesses sending texts to customers.

The figures suggest there is a three-to-one ratio of parcel smishing attacks to banking smishing attacks.

Voicemail smishing, which is where scammers send a text pretending to have a link to a voicemail, is a more recent technique.

What can businesses do to protect customers from smishing?

Advertisement

Fraudsters can trick people into disclosing their personal, banking and account details, often by impersonating mobile phone operators themselves and offering upgrades.

Reports have also been received of criminals using other communications methods, such social media platforms, to impersonate mobile phone companies.

Which? has published an SMS best practice guide for businesses to help protect their customers from potential fraud.

The consumer group also suggests that businesses should avoid hyperlinks where possible and not include phone numbers.