What Is Smishing? How Text Scam Attacks Work & How to Stop Them

Download Our FREE Insurance Guide

Learn everything you need to protect your small business.

Your email address will be used by Zensurance to provide latest news, offers and tips.
You can unsubscribe at any time.

What Is Smishing?

Smishing is a type of cyber-attack carried out through mobile text messages. The name ‘smishing’ is a portmanteau of SMS (short message service, aka texts) and phishing, which is typically an email-based attack.

It’s when a cybercriminal uses text messages to try to get a recipient to click on a link in a text they receive and subsequently provide personal information about themselves.

Smishing scams often target small business owners by impersonating clients, suppliers, or financial institutions. Unlike phishing emails, smishing exploits the immediacy of mobile communication, making it easier for hackers to trick victims into clicking malicious links.

How to Identify a Smishing Message

There are a few ways to identify that a text message you receive on your personal or business mobile phone may be a smishing attack, such as:

• Language that pressures or requests that you act quickly
• Messages you receive from unknown senders or suspicious-looking phone numbers
• Requests for personal information or to verify passwords and information
• A message that contains spelling and grammar errors or awkward phrases
• Messages offering free services or products
• Texts from banks or delivery services like Canada Post or FedEx asking to click a link
• Messages pretending to be from Canada Revenue Agency (CRA) about tax refunds

How to Respond to Smishing Attacks and Stay Safe

There are several ways you can protect yourself and your business from smishing and other phishing attacks, including:

1. Do not respond to a suspected smishing message. Attackers are seeking ways to fool you into replying or engaging with them to identify active mobile phone numbers.

2. Canada’s Competition Bureau warns against clicking on suspicious links and advises forwarding texts to 7726 (SPAM), so that your cellular provider can investigate further. 

3.Delete smishing messages, block the number, and ignore texts even if they ask to reply with “STOP” or “NO.”

4. Avoid using a digital wallet on your mobile phone to keep your financial information safe. That way, things like your credit card number can’t be stolen from a digital wallet if your phone is compromised or physically stolen.

5. Install a mobile anti-malware app that offers protection from links in smishing messages, and keep your phone’s operating system updated.

6.To access mobile apps, always enable multifactor authentication (MFA). Beyond a username and password, MFA requires users to provide one or more forms of authentication to access a device or application. Many MFA tools verify user identity through biometrics, geolocation, or IP address. 

7. If your employees use personal devices for work, consider a Mobile Device Management (MDM) platform. MDM solutions offer robust security features, such as the ability to remotely wipe data from lost or stolen devices, making them a worthwhile investment for managing and securing employee devices.

8. Train your employees on how to recognize suspicious texts and deal with them safely. You could also test your employees’ cybersecurity awareness by simulating a smishing attack within your company to improve their preparedness.

9. Back up business data from mobile devices regularly, and use off-site or secure cloud storage solutions to store the data.

Can Insurance Help a Small Business Recover From a Smishing Attack?

Yes. Cyber liability insurance and cybercrime insurance can cover financial losses caused by smishing attacks, ransomware, data breaches, and other cyber threats.

Coverage often includes the cost of notifying affected customers, legal fees, data recovery, and even PR expenses to repair reputational damage.

Frequently Asked Questions About Cyber Insurance

• How much does cyber insurance cost for a small business in Canada?
  Professional liability insurance policies typically include cyber liability coverage with a low limit of $50,000 for an additional $100-$200 annually. However, businesses handling sensitive data or needing higher coverage may choose a standalone policy, which can range from $750-$1,000 per year.
• Is smishing the same as phishing, and does insurance cover both?
  No. While both are social engineering attacks, phishing typically occurs via email, whereas smishing utilizes text messages (SMS). Cyber insurance policies generally cover both types of attacks.
• Can cyber insurance help if an employee falls for a smishing scam?
  Many smishing attacks are successful because employees unknowingly click on fraudulent links. Cyber liability insurance can cover losses caused by human error, including data exposure or financial transfers that result from a scam.

How to Get Low-Cost Cyber Insurance Quickly

Getting the comprehensive, low-cost cyber insurance you need to protect your small business is quick and easy through Zensurance.

As Canada’s leading small business insurance provider, we help small business owners, independent professionals, and entrepreneurs protect their finances and assets from unexpected accidents, damages, and losses beyond their control.

Complete our online application for a free insurance quote in less than five minutes.

Our knowledgeable team of licensed insurance brokers will shop our partner network of over 50 insurers to find the right policy that suits your business and budget, customize it, and issue your policy documents and a certificate of insurance in 48 hours or less.