Cyber threats to our health organization can come from many different places and can take multiple forms. While phishing is a common method of attack for hackers, it is not the only tool at their disposal.
Did you know?
Sometimes hackers will employ a social engineering technique known as “smishing” (from SMS phishing). These attacks function much like a phishing attack, but the scam occurs through text instead of through email. Since text scams are less common than email scams, it is easier to be caught by one unexpectedly, but these attacks can be just as dangerous as a phishing attempt.
Often these attacks involve the hacker impersonating someone reputable or influential within an organization and using this false identity to build trust and obtain personal information from the target of the attack. Frequently sought information includes passwords, credit card numbers and bank information. As the hacker gains more information about their victim, though, they may go on to impersonate this individual to get to someone else.
An actual smishing attempt at Ballad Health
While we’ve changed the names, this is a real-life example of a smishing attempt on a Ballad Health team member from someone impersonating one of our executive leaders.
“Hi Sue, let me know if you got my text. Joe”
“Hello, I hope you are well. Can I help with something?”
“Okay I have an urgent task for you, Are you free?”
“Sure”
“I’m on a conference call meeting right now and I’m planning a surprise for some of the staff with gift cards and your confidentiality would be appreciated in order not to ruin the surprise.
Are you close to any nearest store that has them in stock?”
Fortunately, the team member was suspicious of the text and reported it to our IT team.
How can I identify and avoid smishing attempts?
There are some general tips that you can employ to avoid falling prey to a smishing attempt.
- Be wary of texts from new, unrecognized numbers, especially if it is someone you know who usually contacts you from a different number.
- Don’t respond to or click links in texts from numbers you don’t recognize until you confirm the sender’s identity. Even if the message seems urgent, don’t send any confidential or personal information.
- A Ballad Health executive will never ask you for financial or confidential information over text. Any such requests are probably smishing attempts, especially if they are urgent, if they contain bizarre spelling or grammar errors, or if they come unexpectedly.
- If you are suspicious of a request, confirm the sender’s identity before taking any action. Try to use an alternate method to contact the individual if you are suspicious about who is actually texting you.
How to report smishing attempts
If you suspect a message to be a smishing attack, the best way to handle it is to report it to your cellular provider. If the suspected smishing attack involved a Ballad Health service or impersonation of a Ballad Health team member, use ServiceNow to send information of the attack via a ticket. If you are using the IT ServiceNow self-service portal, report it as an issue (what’s more commonly known as a break/fix). Be sure to include a screenshot of the attack message when you report. If you feel the smishing attempt requires urgent attention, contact the IT Service Desk immediately by phone at 423-431-6290.
