Smishing is a type of cyberscam that involves sending texts while impersonating a reputable person or company in order to gain personal information from the victim, such as passwords, credit card numbers or bank information.
Often, this fraudulent activity has two stages. In the first, the attacker impersonates someone and convinces the victim to reveal personal information. In the second, once they have enough information, the attacker will impersonate the victim in order to propagate the scam and get to other people.
This often starts with the attacker sending a message to prompt some sort of change or request information:
“Mary, It looks like there was some suspicious activity on your work laptop. We need to resolve this immediately. Reply ASAP. – John”
The attacker is usually trying to build trust with the victim, sometimes by impersonating a supervisor or higher-level manager. As the attacker gains a stronger connection, they can gain more information, making it easier for them to impersonate the victim.
The end goal is almost always monetary gain. Financial information is most frequently stolen, but an attacker who can’t get access to financial accounts might try to ransom other information, threatening to release it or use it in damaging ways.
As trust increases, the attacker can gain more information:
“Ok, I think I can resolve the issue from here. I need you to send me your ID number and password right now, though, or you could lose important info. – John”
To avoid becoming a victim, do not reply to any unwarranted calls or messages from numbers that you don’t recognize. Remember that you don’t know for certain who is actually on the other end of the conversation, and if you do need to reply, be careful about what you share. Block suspicious numbers on your phone and find a way to verify the identity of the texter/caller if necessary. Be sure to report any suspicious messages to your cellular provider as well as to Ballad Health IT Security, if relevant.
Like many hospitals and organizations across the nation, Ballad Health has been the target of cyberattacks, including from people who are looking for money or information. Some of these attacks have even targeted high-level executives. It is always our priority to keep our patients and their information safe, and you can help by carefully monitoring your interactions via phone and text.
Frequently Asked Questions
What is smishing?
Smishing is similar to phishing, but it is commonly performed through text message or phone calls from attackers impersonating someone else to steal information. This always involves convincing a victim to take some sort of action, whether it’s sending info or money, clicking a link or making an account change.
How can I verify that someone texting me is who they say they are?
If you receive a text from someone you know from a new, unrecognized number, it might be an attacker impersonating someone. Try to use an alternate method to contact the individual if you are suspicious about who is actually texting you.
How can I avoid becoming a victim?
Don’t respond to or click links in texts from numbers you don’t recognize. Even if the message is urgent, don’t send any confidential or personal information.
How can I report smishing attempts?
If you suspect a message to be a smishing attack, the best way to handle it is to report it to your cellular provider. If the suspected smishing attack involved a Ballad Health service or impersonation of a Ballad Health team member, use ServiceNow to send information of the attack to IT Security. Be sure to include a screenshot of the attack message when you report.
