Typo domain names used for smishing
Smartphones are vulnerable to malware
In recent months, we've received multiple reports about SMSs and other messages with links to malicious websites. The domain names in the links look like the names of well known organisations. But the addresses in question are actually used for phishing or installing malware. The scam is known as 'smishing' (SMS + phishing): a tactic that's been around a while, but has made a comeback since the coronavirus crisis hit.
Smartphone malware
Smishing is very like phishing. But, instead of using e-mail, it uses a messaging app and targets the victim's smartphone. The reason being that many people nowadays save card details or other financial information on their phones. Tapping the link in a smishing message triggers the installation of malware on the user's phone, and the malware then harvests data for the scammers.
No spam filters on SMS traffic
Smishing often works because people are less suspicious of SMS messages than e-mails. However, it's not a new tactic: a study was published back in 2014 highlighting smishing as the most common way of getting malware onto victims' phones. Unlike e-mail traffic, SMS traffic isn't filtered for spam, making it attractive to fraudsters.
Smartphones are vulnerable to malware
Another problem is that many users mistakenly believe it's impossible to instal malware on their phones. The truth is that Android devices are vulnerable to malware. And, while malware is rare on Apple phones, they too can be hacked if they're jailbroken.
Smishing relies on lookalike domain names
Smishing is even more dependent on fake domain names than phishing is. That's because text links aren't possible in SMSs. Only full-length hyperlinks or addresses generated by URL shorteners can be used. You can't therefore write the name of a bank and link it to a completely different URL, the way you can in an e-mail. It's therefore very important to the scammers to have domain names that look like the names of trusted organisations. Here's a good example, from a recent scam targeting users of the DigiD payment system:
Although the URL in the message looks like a DigiD domain, it ends with '.me', Montenegro's country-code domain. Dutch government policy doesn't allow the use of extensions such as .me for official websites. But many people don't know that. And they're used to seeing names that end '.me', which is widely used outside Montenegro. The same is true of .ly (Libya), which is popular with URL shorteners.
URL shorteners
URL shorteners generate short URLs that point to longer ones. Lots of legitimate organisations use shortened URLs in SMSs. So people are used to seeing them and don't tend to be suspicious. What many don't realise is that the shortened URL can be previewed by briefly holding your finger on the link. The link isn't actually opened until you tap it. For smishing, scammers often use domain names that look like URL shorteners. Here's a good example:
How to stop smishers abusing your organisation's name
What can you do to prevent smishing and limit its impact? We've got three top tips:
Coach your staff to spot not only mail-based scams, but also frauds that use SMS and other media. Stress that cyber-attacks take many different forms.
Smishing scams typically target smartphones. So make sure your staff know what is and isn't allowed with company smartphones. Don't allow jailbreaking, and think carefully about the security of financial and login details on company phones.
Make sure you've got a consistent domain name policy and that everyone knows it. The Dutch government requires certain extensions to be used for some official purposes. That makes it easier to spot scam sites. Along with fake webshops, e-mail-based phishing and spear phishing, smishing shows that, sadly, lookalike domain names can be abused in more ways than many people imagine.