Smishing: Text Messages You Can Ignore

If you receive an urgent text message prompting you to click a link and provide information, take a moment to think it through.

These messages, known as “smishing,” have become increasingly common.

What is smishing?

Smishing is “SMS phishing” or a text-message scam. Scammers send texts that seem legitimate to trick you into clicking on malware-filled links or entering your personal information into fake websites.

Unfortunately, these scams are getting harder to detect. Here are two of the most common smishing scams out there.

1. Unpaid Tolls

These text messages appear to be from a tollway processing service. They appear urgent, stating that you have overdue toll charges you need to pay immediately to avoid a late fee. They conveniently provide a link to settle the balance and may even include reference numbers to make the message seem legitimate.

If you click the link, you are sent to an official-looking site and asked to provide your card information (full number, address, code and expiration). You may even be asked for online banking login credentials, such as username and password, as an additional “authorization” for payment.

2. USPS Undeliverable Package

In today’s world of online retailers and subscription services, we expect packages to arrive regularly. These scam messages take advantage of this fact.

Scammers send you a text, claiming to be USPS. They state that a package has been delayed or could not be delivered and that you need to verify your account information to restart the delivery process. They may even include a fake reference number and the USPS logo to make the text message seem more legitimate.

If you click the link, you're directed to an official-looking site and asked to input your address and card information to verify your identity. Typically, the site will state you can expect a small charge to appear on your card as a ‘fee.’ Sometimes you'll even get a push notification or one-time passcode sent to your phone.

The message may also request a reply; if you reply, the scammer knows there's a person who they can continue to contact.

Why you should pause before you respond

Unfortunately, if you click the link and share the requested information, scammers will have full access to your information. They will attempt to make fraudulent transactions as soon as card or account info is supplied. If an OTP was shared, they often add your card to a new mobile wallet (digital account) and continue to spend the funds.

Links in unexpected text messages can also contain malicious software. Clicking them can cause problems on your device.

I clicked the link. Now what?

First, cancel your current card and have a new card number issued. You can do this on the UWCU Mobile App, Web Branch or by contacting us.

Next, dispute any of the transactions posted to your accounts. Note: the transactions must clear the account before we can attempt the dispute. If the transactions are pending, you may need to wait a few days.

We recommend you choose your online banking password wisely and update it regularly. Avoid using the same password across multiple accounts.

Finally, have your device checked for malware. If you notice your phone is slower than usual or there are new apps you don't remember downloading, that's a potential sign that your device has a virus.

Scammers keep getting savvier, so you need to stay aware. Use enhanced security features like card lock/unlock and instant notifications to protect yourself.

Trust your instincts. If something feels off, listen to that feeling.

Have questions?

Contact us Monday – Friday, 8 a.m. to 5:30 p.m. CT, and Saturday from 9 a.m. to 1 p.m.