How to identify and stop sms smishing scams for your business

Summary

This guide helps you troubleshoot and resolve: How to identify and stop sms smishing scams for your business. Follow the steps below to fix the issue.

Common Causes

SMS smishing is a type of phishing attack delivered via text message. Unlike email phishing, smishing targets your mobile phone directly, often using urgency or fear to trick you into clicking a malicious link or providing sensitive business information. Small business and home office users are frequent targets because they often manage their own accounts and may not have dedicated IT security staff.

What Is SMS Smishing?

Smishing (SMS phishing) occurs when a scammer sends a fraudulent text message pretending to be from a trusted organisation. The goal is usually to steal login credentials, payment details, or to install malware on your device. These messages often impersonate well-known Australian organisations such as Telstra, major banks, energy providers, mobile carriers, Australia Post, or government services.

How to Identify a Smishing Message

Not every suspicious text is obvious, but most smishing attempts share common warning signs. Look for the following indicators:

• Unexpected messages from organisations you do not have an account with
• Urgent language demanding immediate action (for example, "your account will be suspended" or "unauthorised login detected")
• Links to websites that do not match the official domain of the organisation
• Requests for personal or business information, such as passwords, myGov details, or credit card numbers
• Messages claiming you have won a prize or have a parcel waiting for delivery
• Sender numbers that look random, international, or are hidden behind a short code

Quick Fix Steps

If you receive a suspicious SMS, follow these steps immediately:

1. Do not click any links in the message.
2. Do not reply to the message, even to say "stop" or "unsubscribe."
3. Do not call any phone number provided in the text.
4. Delete the message from your device.
5. Block the sender number using your phone's built-in blocking feature.

Detailed Instructions

Verifying the Legitimacy of a Message

Before taking any action on an unexpected text, verify it through official channels:

1. Open your web browser and navigate directly to the organisation's official website by typing the address manually.
2. Log in to your account through the official website or mobile app to check for any notifications.
3. Contact the organisation using a phone number or email address found on their official website—not the details provided in the SMS.
4. If the message claims to be from a government service, log in to your myGov account directly through my.gov.au to check for messages.

Blocking a Sender on iPhone

1. Open the Messages app.
2. Open the conversation with the suspicious sender.
3. Tap the sender's name or number at the top of the screen.
4. Tap the info button.
5. Tap Block this Caller, then confirm by tapping Block Contact.

Blocking a Sender on Android

1. Open the Messages app.
2. Long-press the conversation with the suspicious sender.
3. Tap the Block icon or select Block from the menu.
4. Confirm that you want to block the number and report it as spam if prompted.

What to Do If You Clicked a Link or Responded

If you have already interacted with a smishing message, take the following steps to limit potential damage:

1. Disconnect your device from mobile data and Wi-Fi if you suspect malware may have been installed.
2. Change passwords for any accounts you may have accessed or entered credentials into after clicking the link. Use a different, trusted device to do this.
3. If you entered banking or payment details, contact your financial institution immediately using the number on the back of your card or from their official website.
4. Run a full security scan on your device using reputable antivirus or mobile security software.
5. Check your business and personal accounts for any unauthorised transactions or changes.

Reporting SMS Smishing in Australia

Reporting smishing helps authorities track scam trends and protect other businesses and consumers.

Report to Scamwatch

Scamwatch, run by the National Anti-Scam Centre, collects reports of scams affecting Australians.

1. Visit the Scamwatch website.
2. Select the option to report a scam.
3. Choose "SMS" or "text message" as the contact method.
4. Provide details including the sender number, message content, and any links included.

Report to the Australian Cyber Security Centre (ACSC)

If the smishing attempt involved cybercrime, such as malware or unauthorised access to business systems, report it to the ACSC through ReportCyber.

Report to Your Mobile Carrier

Most Australian mobile carriers allow you to forward suspicious SMS messages to a dedicated spam reporting number. Check your carrier's website for their specific smishing reporting process.

Protecting Your Business from Future Attacks

Reduce the risk of smishing affecting your organisation with these preventative measures:

• Train all staff to recognise smishing and phishing attempts.
• Implement multi-factor authentication (MFA) on all business accounts.
• Use a mobile security solution that includes SMS filtering and phishing protection.
• Establish a clear process for employees to report suspicious messages without fear of reprimand.
• Regularly review and update your business's cybersecurity policies.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?