A KnowBe4 co-worker of mine recently got this SMS phishing message (i.e., smish).
They quickly identified it as a social engineering attack and shared it on our internal communication channel for sharing such things.
I have had more and more of these types of similar smishes occurring over the last few months. It is an attempt to trick someone into worrying that their Gemini, Gmail, Microsoft, Instagram…or whatever account…is in the middle of being compromised and you need to react NOW! NOW! NOW! to prevent it from being taken over.
For me, most of them involve Gmail account warnings.
The premise is that your account is under attack, a hacker is trying to reset your authentication and take it over by generating a code to reset a password or set a new multi-factor authentication instance. The scammers want you to panic and follow the instructions.
The warning messages are not that different from real notification messages sent by real vendors, with a few caveats, including:
- You did not initiate the account reset (this is the number one clue!)
- Comes from a strange or unrecognized phone number (not all that strange by itself)
- The number it is originating from does not match the number/area code you are being asked to call (real requests often originate from “short numbers” instead of phone numbers)
- Sense of urgency involved (you will suffer damage if you do not call now)
Besides your initiation of the reset request, most legitimate reset messages include URLs to the vendor’s legitimate website and domain, not a phone number. I’ve never seen a real notice message that included a “reference code”. I guess that's “official sounding.”
However, I have gotten real reset messages with just a phone number to call and not a URL. Not all SMS messages containing only phone numbers to call are fake. But I am usually expecting them and if I research the phone number, the vendor’s legitimate website comes up right away listing the phone number.
When I research a phone number involved in a spoof, it never comes up under a vendor’s legitimate website (although it can have a vendor’s name attached to it in a search result…but pointing to a fake of the vendor’s website or as reported on spam sites).
When in doubt about a reset message, contact the vendor using their valid, legitimate URL. If there is a problem with your account, the problem will still be there when you log into the vendor’s website. They do not just send you an SMS message and call it a day.
Most importantly, never call the phone number in the message. With spoofed messages, that phone number will usually be answered by a very friendly voice claiming to work for the company. Sometimes they have fake “hold music” that repeats the company name. You cannot trust a phone number sent to you in a message without researching it first.
Be careful when researching because some fake numbers have been researched by potential scam victims so much that they will appear as belonging to the claimed company…but will not, most importantly, be listed on the legitimate company’s website. When in doubt, call the company on a known good phone number.
I also get an occasional reset request from services I do not belong to, like this one below.
I can see someone’s spouse possibly getting mad over this one!
Same deal here. The scammer is taking a chance that the recipient belongs to the service or site and gets spooked into thinking someone is trying to hack their service. Although in this case, I guess they are hoping you will call or text the involved number?? Either that or someone has used my phone number on Tinder (on purpose or by accident).
Yes, it cannot hurt to report the number as spam using your phone’s legitimate spam reporting service.
The stats on harmful SMS messages are pretty stark. More than one billion unwanted SMS messages per minute are sent globally and at least one million of those are intentionally malicious. TechJury states that 8.9% - 14.5% of recipients click on malicious links in text messages.
Yes, about 9%-15% of people receiving a scam SMS message click the URL or call the number.
Make sure you, your family, and your co-workers are not one of them.
You will learn more about:
