SMS phishing (or “Smishing”) campaigns often impersonate mobile phone providers, since people are expecting to receive these types of texts. Ducklin cites one example in which the scammers sent text messages purporting to come from EE, one of Britain’s largest mobile providers. The messages told recipients that they needed to update their billing information, and included a link to a phishing page. The URL of the page began with subdomains that mimicked EE’s legitimate website.
Ducklin notes that the scammers didn’t need to target this campaign, since they could get a rough idea of phone numbers based in the UK, and a decent amount of these would be EE customers. Presumably, enough people will fall for the scam that the attackers will probably make far more money than it cost to send out thousands of SMS messages.
Scammers will take advantage of any venue they can use to trick people into giving them data or money. New-school security awareness training can help your employees avoid falling victim to these attacks.