[The Police File]Smishing Can End with a Single Click... Always Suspect Messages, Even from Friends

Stealing Personal Information and Money
Through Internet Links and Phone Numbers
Even Wedding Invitation Links from Familiar Numbers Are Risky
Always Verify Through Another Messenger or Call

‘[International Origin] Your OO card application has been received. If you did not apply, please report immediately. Consultation 02-2XXX-9XXX.’

This is a recent text message received. Upon closer inspection, it is full of flaws. First, it is a domestic card company, but the message was sent from a foreign number. The phone number provided for consultation, when searched online, was reported as spam over 100 times. This is a typical example of a ‘Smishing’ message.

Smishing is a combination of SMS (Short Message Service) and Phishing, referring to a crime where false text messages are sent to steal personal information or attempt voice phishing. Typically, these messages impersonate delivery notifications, event invitations such as first birthday parties or weddings, public institution announcements, card applications, purchase details, or bank loans. At the end of the message, there is an unknown internet address (URL) or phone number. Clicking the link installs malicious software on the phone designed to steal personal information. Smishing messages with phone numbers aim to induce calls that lead to voice phishing.

Smishing message.

Although awareness of phishing crimes has increased, many people still fall victim to smishing messages. This is due to the nature of smishing, which prompts recipients to check the message. The above message exploited the anxiety that someone might have fraudulently applied for a card in the recipient’s name, causing financial damage. However, calling the number in the message connects not to the card company but to voice phishing criminals. The fraudsters answering the call will ask for personal information under the pretense of helping cancel the card or demand money by claiming a deposit is needed to verify the account.

Smishing does not end with just the theft of personal information. In June, Mr. A, a business owner in Busan, lost 140 million KRW after carelessly clicking a mobile wedding invitation link sent via text. The moment he clicked, a hacking program capable of remote control was installed without his knowledge, and the smishing criminals stole Mr. A’s financial certificates stored on his phone, took out bank loans in his name, and withdrew the money into mule accounts.

Smishing text messages impersonating delivery services.

According to data from the National Police Agency, the number of smishing cases increased more than fourfold from 293 in 2018 to 1,336 in 2021. During this period, the amount of damage rose more than twentyfold from 230 million KRW to 5 billion KRW. Since police statistics only include cases reported after recognizing financial damage, it is estimated that there are even more smishing victims who suffered small unauthorized payments without realizing it. The Korea Internet & Security Agency detected 1.8 million smishing messages from 2018 to 2022 alone. This means anyone in the nation can fall victim to smishing.

To prevent smishing damage, it is important to ‘be suspicious’ when receiving suspicious messages containing internet links or phone numbers. Never click on the links or make calls. If the message claims to be from a bank, card company, or public institution, verify the official phone number on their website before contacting them. Even if the message is a wedding invitation from a friend’s number, confirm through another messenger or phone call whether the friend actually sent it, as their phone might have been hacked. It is also necessary to enable the ‘install apps from unknown sources’ restriction in phone settings and keep antivirus programs updated to the latest version. Although inconvenient, these are sure ways to prevent damage.