Smishing

Smishing is phishing carried out through text messages, using fake alerts, delivery notices or prize offers to trick people into clicking malicious links or sharing personal information.

The name combines SMS and phishing. Common smishing messages in Canada claim to be from a bank, Canada Post, a toll or parking authority, a mobile carrier or the Canada Revenue Agency. They usually include a short link and a sense of urgency, such as a failed payment or a package that will be returned.

Staff increasingly use their phones for work email, multi-factor authentication and banking, so a successful smishing attack can expose business accounts as well as personal ones. Phones also show less information about where a link really leads, and people tend to react to texts quickly while on the move.

Practical tip: never tap links in unexpected texts. Go directly to the organization's official app or website instead. Canadian mobile carriers let you forward spam texts to 7726 for investigation, and fraud attempts can be reported to the Canadian Anti-Fraud Centre. Include smishing examples in your staff training.