Apple’s Messaging app features built-in protection from phishing and smishing expeditions. Phishing is when cybercriminals send someone an email that looks like a legitimate letter from a company that the victim does business with. The letter contains a message with an urgent demand that the target do something or face a harsh consequence. The goal is to get the target to turn over sensitive information such as PIN numbers, passwords, and social security numbers all to take over the victim’s financial accounts and steal the money in his/her personal accounts.
Beware of “smishing” messages which are bogus texts made to look like they came from a firm you do business with
Sometimes these phishing messages are sent via text messages in which case it is called “smishing.” Most cybersecurity experts will tell you never to tap on links in emails and texts you receive from senders who are unknown to you. Apple’s iMessage platform automatically disables links in messages sent by unknown senders regardless whether the message was sent via email or text.
Examples of smishing texts that try to get you to respond disabling Apple’s protection from links. | Image credit-BeepingComputer
To trick the iPhone user into responding to the text and disabling the protection, many smishing texts will include a line like this: “Please reply Y, then exit the text message, reopen the text message activation link, or copy the link to Safari browser to open it.” Since many smartphone users have become familiar with the idea of verifying an appointment by typing “Yes,” or just the letter “Y,” the attackers are hoping that the target responds with the “Y” which, as we said, will turn off iMessage’s built-in phishing protection for this text.
What to do if you receive a smishing text
Even if the target doesn’t tap on the now-enabled link, knowing that the target responded to the smishing message lets the attacker know that this target can be tricked into responding to a bogus message. Many of the targets of these smishing attacks are older people who might be more compelled to believe that a smishing text is legitimate and feel that they must settle up immediately to prevent them from receiving a punishment.
If a message you receive has its links disabled, or if it is from an unknown sender asking you to replay to the text, you should not respond. Your best bet is to call the company that allegedly sent the text and ask then whether they sent you a text message and what task they need you to do.
