What is Smishing?
Smishing is a type of social engineering attack that uses deception, bribery, or other techniques to get the victim to do what the attacker wants. Smishing is defined by the fact that it uses SMS text messages, which is the source of its name (SMiShing).
Smishing has grown more prevalent as a cyberattack technique in recent years due to the growing use of mobile devices. Many organizations allow the use of mobile devices for business — either company-owned phones or under a bring-your-own-device (BYOD) program — making SMS a common form of communication.
Additionally, many companies — including financial providers and brands such as Apple, Amazon, and Netflix — are increasingly using SMS to communicate with their customers. This is especially true for urgent communications such as issues with the customer’s account.
Smishers take advantage of this fact to make their attacks more plausible. Smisming messages commonly masquerade as communications from a legitimate provider and are designed to trick the target into clicking on a malicious link. This approach takes advantage of some features of SMS communications, including:
- Link Shortening: Many legitimate brands use link-shortening services (like bit.ly) in SMS messages due to restricted message lengths. Smishers take advantage of the fact that these services hide the destination URL from the user, making it easier to trick a user into visiting a phishing site.
- No Link Mouseover: On a computer, hovering over a link with the cursor can reveal its target. This isn’t the case for mobile devices, making it harder for a user to validate a link before clicking it.
- Always-On Mentality: Most people are constantly connected to their phones and accustomed to instantly reading and responding to SMS messages. This mentality means that smishing messages are more likely to get the target to act without thinking.
What is Phishing?
Like smishing, phishing is a cyberattack based on social engineering. However, it isn’t limited to SMS messages, using a variety of different messaging platforms to deliver malicious messages to the user.
In general, phishing uses one of two main techniques to trick the user. Like smishing, it can use malicious links that direct the target to phishing websites that might be designed to steal user credentials or other sensitive data or install malware on the user’s device. Alternatively, phishing messages can include malicious attachments designed to infect the computer with malware.
While phishing is most commonly associated with email, it is a general term for any attack of this type. Some forms of phishing attacks include:
- Smishing: Phishing via SMS messages.
- Vishing: Social engineering performed over the phone (“voice phishing”).
- Spear Phishing: Phishing attacks are precisely targeted at an individual or small group.
- Whaling: Spear phishing attacks targeted at high-level executives within an organization.
- Business Email Compromise (BEC): Phishing attacks where the attacker impersonates a CEO or other executive to trick employees into sending money or data to the attacker.
The Difference Between Smishing and Phishing Attacks
Smishing is a particular type of phishing attack that uses SMS messages to deliver malicious content. While phishing is often associated with malicious emails, this attack can be performed using any messaging platform, including email, social media, and corporate communication apps like Slack, and SMS.
Phishing and Smishing Prevention with Check Point
Phishing and smishing are two of the most common cyber threats that organizations face. Since these attacks rely on social engineering — tricking, bribing, or coercing the target into doing something — rather than exploiting vulnerabilities, they are often easier for attackers to perform. As a result, cybercriminals commonly use these attacks to steal sensitive information or as a first stage in a multi-phase cyberattack.
Employee education is important to phishing and smishing prevention, but it’s not enough on its own. Phishing attacks are growing more sophisticated — especially with the rise of Generative AI — and even the most careful employee might not be able to identify and respond properly to all of them.
Check Point offers security solutions designed to provide comprehensive protection against all phishing threats, regardless of the medium used to send the malicious content. Check Point Harmony Email and Office provides strong protection against email-based phishing attacks and has been named a Leader in the 2023 Forrester Wave for Enterprise Email Security. To manage the smishing threat, Check Point provides Harmony Mobile, which can address this social engineering risk as well as other mobile-focused attack vectors. To learn more about how Check Point can protect against phishing and smishing, sign up for a free demo of Check Point Harmony Email and Office and Harmony Mobile today.
Feedback