Browsing This

Text message phishing: Don’t give away your identity on your phone

Posted in December 27th, 2008

US Bank was one of many banks that text message phishers claimed to representText messages on our cell phones make everything more convenient. Banking is no exception, and many banks now offer text message alerts and updates, such as notifications when our balances are low. Mobile banking makes many people’s lives easier. But of course, with this convenient technology comes another means of stealing your identity, and you must be careful not to fall for the latest tricks.

Recent reports indicate a rise in text message phishing. Phishing, for those not in the know, means sending messages that claim to be from banks or other financial institutions and which use fear and urgency (”Your account will be closed immediately unless you respond”) to try to trick victims into giving up their sensitive information. Cell phone text messaging had already become an avenue for spam messages, which are annoying but not particularly dangerous from an identity theft perspective. Now, the combination of spam texts and illegal intent has led to a rise in text messages that try to provoke a response. The response that the phishers want contains your Social Security number, bank account number or other private information. It’s the same old thieves wearing a newer, cooler costume.

The most recent major text-message phishing scam was reported nationwide just a few weeks ago. In this particular effort, phishers sent untold numbers of bogus text messages, claiming to represent U.S. Bank. The messages said, “Dear US Bank member, your account with us is closed due to unusual activity, call us at [number withheld].” The recipients represented customers of various cell phone providers and were not necessarily U.S. Bank customers. Like many email phishing schemes, this one had a broad scope in the hopes of getting a few victims to nibble at the bait. It’s difficult to know how many people fell for the scam, but the three return phone numbers that were known to be used in the phishing texts have been shut down by the state.

Banks, meanwhile, must now work to make sure that customers who benefit from their mobile banking services aren’t burned by the same technology. U.S. Bank issued a statement shortly after the phishing attempts were reported, reminding account holders that U.S. Bank does not request sensitive information via email, phone call or text message. CIBC, the Canadian Imperial Bank of Commerce, is one of many financial institutions providing additional information online about phishing, including ways to check for an email’s legitimacy and ways to report fraudulent communications. Most banking websites include safety and security information for consumers, even if consumers don’t always read or heed the warnings.

The advice, of course, has been heard before: treat suspicious texts the same way you treat suspicious emails. Don’t reply, don’t call any phone numbers listed, and don’t go to any websites suggested in the message. If you do receive a message claiming to be from your bank, call your local bank office or a trusted customer service representative (using a number you already know to be valid) to investigate the issue. Remember, no bank is immune to being used as text-phishing bait (Oregon-based Bank of the Cascades was used as a phishing front several months ago, for example, so scammers aren’t limiting their phishing efforts to national banks), and no cell-phone-toting consumer is immune from the potential attack.

If you still have doubts about mobile banking, you can elect to discontinue it entirely. As IdentityTheft.com noted, mobile banking has many pros (including ease of use, free updates and no account numbers sent in text messages), but it also has many cons (including potential lack of encryption, lack of security and lack of anti-virus software in some phones). The site notes that the technology is still fairly new and untested and suggests asking both the bank and the cell phone provider about the security of the systems used before signing on for mobile banking, just in case. When in doubt, consumers can just skip the mobile updates and do their banking the old-fashioned way (well, as old-fashioned as “online” can be). That way, ANY text messages that claim to represent the bank can be known as fraudulent the minute they arrive on one’s phone.

Sources for this article: Minneapolis Star Tribune, CIBC, IdentityTheft.com, ConsumerAffairs.com

6 Users Commented In " Text message phishing: Don’t give away your identity on your phone "

Subscribes to this post Comment RSS or TrackBack URL
Trackback & Pingback
2-3-2009 at 12:00:17 from 209.51.134.186    
2-24-2009 at 09:00:15 from 174.132.149.162    
Jessie love this post,
3-21-2009 at 08:01:15 from 74.200.193.18    
6-18-2009 at 06:00:38 from 174.132.149.162    
8-5-2009 at 12:00:32 from 174.132.149.162    

Sorry the comment area are closed

Sign Up for Privacy Council Now!