Keeping Your Money Safe: Smishing Fraud Scam

You’ve likely heard of a phishing scam but are you familiar with smishing? Smishing refers to a scam sent via SMS text message, allowing fraudsters to target victims in order to steal personal information and hack into bank accounts without even sending a link to click on.

How Does the Scam Work?

In a smishing scam, fraudsters send a linkless text message claiming there’s been a bank transfer from your account. The message usually asks if you’ve authorized the transaction from your debit card, through Zelle, or even from a retailer. Anyone who answers the ‘yes’ or ‘no’ question in the text message receives a phone call almost immediately after.

When you pick up the phone, the person calling claims to be from your bank’s fraud department to help secure your account. The so-called “fraud department” then asks you for your online banking username and tells you to read back the passcode sent to you via text or email. When the fraudster enters your username into your banking website, he/she initiates the “forgot password” feature, which generates this passcode text message. The fraudster claims they are asking for the passcode in order to verify they are speaking to the correct party.

By giving out this passcode, you allow the fraudster to reset your password and successfully gain access to your account without your knowledge. The scammer then transfers funds out of your account, often using Zelle to do it. It’s important to note that fraudsters never even need your password in this scam. By giving out your username and the one-time code you receive, they have access to your account.

Stay Alert for Fraud Scam Behavior

To avoid falling prey to a smishing scam, it’s important to remember the following points:

If you receive a text message like this, ignore it and call your financial institution.
If someone calls you claiming to be the fraud department, and you have doubts, hang up. Call your bank and ask to be transferred to the fraud department.
Your bank will never ask you for an authorization code to verify your identity.
If your bank sends you a notification to validate a transaction, you will never receive an immediate phone call asking for your login information. The verification is the text answer you send back.
These smishing scams often come from banks that you don’t even bank with. Don’t fall for it.
If you are uncomfortable about a text message or call, ignore it and call your bank so they can assist you directly.