Body
Overview
Smishing is phishing carried out through text messages. The name combines SMS, a common type of text message, with phishing.
A smishing message tries to make you click a link, call a number, reply, send money, or provide information. The message may appear to come from a bank, delivery company, government agency, employer, university office, or someone you know.
Text messages often feel immediate and personal, which can make a fraudulent request seem more believable. A message can also display a familiar name, short code, or phone number without being legitimate.
How It Works
A smishing message usually creates urgency, curiosity, or concern. Common examples include:
- A package cannot be delivered until you pay a small fee.
- A bank or payment account has suspicious activity.
- An unpaid toll, invoice, or bill requires immediate payment.
- A refund, prize, scholarship, or job opportunity is waiting.
- An account will be suspended or deactivated unless you verify it.
- A person claiming to be from technical support asks for a code.
- A message claiming to be from the UM Help Desk says your email will be deactivated and directs you to a short link or asks you to send a verification code.
The link may open a fake sign-in or payment page. The phone number may connect you to a scammer. A reply may confirm that your number is active and give the scammer an opportunity to continue the conversation.
Warning Signs
Watch for:
- An unexpected text asking you to act immediately.
- A link that is shortened, misspelled, or unrelated to the organization named in the message.
- A request to reply with a password, verification code, MFA code, account number, or personal information.
- A request for payment by gift card, cryptocurrency, wire transfer, payment app, or another unusual method.
- A message about a package, toll, account problem, refund, or job that you were not expecting.
- A request to move the conversation to another messaging application.
- A message from a known person that uses unusual wording or makes an unusual request.
- A claim that you must act before you have time to verify the situation.
Poor spelling can be a warning sign, but many smishing messages are well written and professionally formatted.
How to Protect Yourself
- Do not click links in unexpected texts. Open the organization's official application or type its known website address yourself.
- Do not call a number provided in a suspicious message. Use a number from an official website, statement, card, or contact list.
- Do not reply to a suspected scam text, including with personal information or a verification code. Use your phone's report, junk, or spam feature instead when available.
- Verify unusual requests through another channel. Call the person at a number you already know or contact the organization through its official site.
- Never share passwords or MFA codes. A verification code is intended for the person signing in and should not be given to someone who contacts you.
- Use spam filtering and blocking features provided by your phone or mobile carrier.
- Report the message before deleting it. Reporting helps the provider identify similar messages.
For legitimate marketing messages from a company you recognize, normal unsubscribe instructions may be appropriate. For an unexpected or clearly fraudulent message, do not engage with the sender.
What You Should Do at UM
UM IT will not ask you by text message to provide your password, send an MFA code, approve an unexpected MFA prompt, or provide payment information.
If a text claims to be from UM or concerns a UM account, class, job, payment, or service:
- Do not click the link, reply, or call the number in the message.
- Verify the request through an official UM website, a known UM contact, or the UM directory.
- Report the message to the UM IT Helpdesk or UM Information Security Office.
- Use your phone or carrier's spam-reporting feature, then delete the message.
If you clicked a link but did not enter information or install anything, close the page. Opening a link does not automatically mean that your phone is compromised. Contact support if the link caused a download, asked you to install an application or configuration profile, or you entered information.
If you entered your UM password, shared an MFA code, or approved an unexpected MFA request, change your UM password through the normal account-management process and contact the UM IT Helpdesk or UM Information Security Office immediately.
Additional Questions
For a text involving a UM account, UM service, university data, or UM business process, contact the UM IT Helpdesk and the UM Information Security Office.
For a personal text-message scam:
- Use your mobile carrier's official spam-reporting and blocking instructions.
- Contact your financial institution immediately if you provided payment information, sent money, or notice unauthorized activity.
- Use the relevant account provider's official recovery process if you entered a personal username, password, or verification code.
Additional Resources