If you haven’t heard of smishing, don’t worry, it’s not a common term. But if you have an iPhone you need to be aware of what smishing is as you could fall victim to a dastardly cybercrime if you aren’t on the lookout for the right signs.
Smishing is short for ‘SMS phishing’, which is a method of cyber scam criminals use to try and convince people to willingly part with sensitive personal information. This data can then potentially be used to defraud the unsuspecting victim.
This could be a text message pretending to be your bank, phone provider, or even a relative asking for help. They can often be very convincing, and fraudsters have ways of even naming the text so it looks like it is coming from a company rather than a random number or email address.
To try and fight the fraud, Apple’s iMessage service automatically disables links in text messages from unknown numbers or email addresses. This means even if you are tricked into tapping on a bad link that could take you to a fake webpage that could steal your data if you type it in, your iPhone will stop you from doing so, hopefully alerting you to the potential danger.
But in a concerning twist, Apple confirmed to Bleeping Computer that if you reply to one of these messages or if you add the unknown sender to your contact list, the blocked links will actually be enabled, meaning you could then be susceptible to the smishing attempt.
Bleeping Computer said it “has seen a surge in smishing attacks that attempt to trick users into replying to a text so that links are enabled again”, including texts purporting to be from delivery couriers and from unpaid road toll firms.
Unlike older smishing attempts, these ask the recipient to reply with “Y” for yes, and then it instructs you to “exit the text message and open it again to activate the link”. This is a brazen way around iMessage’s smishing protection, as the criminals are saying exactly what needs to be done to activate the dodgy link without giving the game away.
“As users have become used to typing STOP, Yes, or NO to confirm appointments or opt out of text messages, the threat actors are hoping this familiar act will lead the text recipient to reply to the text and enable the links”, Bleeping Computer said.
“Even if a user doesn’t click on the now-enabled link, the act of replying tells the threat actor that they now have a target that responds to phishing texts, making them a bigger target.”
Less savvy iPhone users may not be able to spot fake messages such as these and will be far more likely to be fooled by a smishing attempt. If you aren’t quite sure if a message is legitimate, it’s always best to err on the side of caution and ask for a second opinion from a friend or family member, or simply delete the message.
