New Convincing Verizon Smishing Scam Makes SIM Swaps A Breeze

Closeup portrait perplexed young man looking at smart phone seeing bad news or photos with confused emotion on his face isolated on gray wall background. Human reaction, expressionCybercriminals intent on using a mobile device as a second factor of authentication are now using texts and very realistic-looking mobile sites to steal details needed to perform SIM swaps.

Mobile devices are inherently trusted by most users. So, they make the perfect medium by which to trick users into giving up private information that can be used against them. In a new scan, users are sent “security alerts” that are made to look like they are coming from your wireless carrier. Upon clicking the provided link, the victim is presented with a very convincing website where the user needs to “validate their account”.
2-13-20 Image

Source: How To Geek

Should the victim walk through the entire scam, they give up every bit of information needed to take control of their account. It stands to reason the next step is a SIM swap, but that’s only worthwhile when used as part of a spear phishing scam intent on stealing the very same user’s online credentials to, say, their Office 365 account or banking site.

This scam highlights how an attack that simply uses a) a trusted device and b) a realistic-looking website can fool an unsuspecting user. The only real telltale sign in this scam is the URL (see the image above). You organization’s only real defense against this portion of what can only be assumed is a larger attack is to elevate the user’s security mindset and vigilance when receiving texts, opening emails, and surfing the web. Security Awareness Training continually keeps users up-to-date on the latest attack methods and the need for user participation in organizational security.

The illusion of legitimacy this attack leverages is a real benefit to cybercriminals; with it, they can fool just about anyone if the context and timing is right. Teaching users to always have their defenses up is, legitimately, your only viable defense.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews