Hands holding a mobile phone.

Cybercriminals use a variety of methods to target victims, including text message scams (smishing), phone scams (vishing) and increasingly, AI-generated scams that mimic trusted individuals and organizations. Understanding how these attacks work can help you recognize and avoid them.

Text messages can contain links to things such as webpages, email addresses or phone numbers that when clicked may automatically open a browser window or email message or dial a number.

This ruse tends to be effective because while most of us have learned to recognize phishing emails, we are still conditioned to trust text messages. Also, there’s no easy way for us to preview links in a text message like we can if we are viewing an email on a PC. Cybercriminals increasingly use text messages to impersonate banks, delivery services, government agencies and other trusted organizations. Some scammers also use artificial intelligence (AI) to create more convincing and personalized messages.

Suspect a smish?

Smishing is a form of social engineering that exploits SMS, or text messages.

Watch out for QR codes
Some text-message scams include QR codes that direct users to fraudulent websites designed to steal passwords, financial information or other sensitive data. Before scanning a QR code, verify that it came from a trusted source. 

Validate any suspicious texts
If you get a text allegedly from a company or government agency, check your bill for contact information or search the company or agency's official website. Call or email them separately to confirm whether you received a legitimate text. A simple web search can thwart a scammer.

Don't engage
Never click links, reply to text messages or call numbers you don't recognize. Be cautious of messages requesting passwords, one-time passcodes or multifactor authentication (MFA) verification codes. Legitimate organizations typically do not request these through text messages. Do not respond, even if the message requests that you "text STOP" to end messages.

Delete it
If you don’t know who it’s from and it looks suspicious, simply delete the text.

Update your device
Make sure your smart device OS and security apps are updated to the latest version. Enable automatic updates whenever possible to help ensure security patches are installed promptly.

Add extra security
Consider installing anti-malware software on your device for added security.

Spot the signs of vishing

Vishing is a telephone-based form of social engineering in which someone calls you directly and pretends to be from a legitimate company or service. Once on the line, they ask questions, try to get you to do something, or direct you to a website in order to obtain personal information, such as Social Security or financial account numbers. Some scammers also use AI-powered voice-cloning technology to imitate company representatives, government officials, coworkers or even family members.

Check the company
Is the phone call from a legitimate company? If you can, look up the phone number or company name to see whether it’s legitimate. Always be extra cautious if it’s a company you’re not familiar with. Be aware that caller ID information can be spoofed. Even if a familiar company name or phone number appears on your screen, it does not guarantee the call is legitimate.

Call them back using a number you have on file
If the caller says they are from a company you know or do business with, hang up and call them using a trusted phone number from your records, a statement, the company website or the back of your card.

Watch out for requests for sensitive information
Be suspicious of requests for sensitive information, such as user IDs and passwords, financial account numbers or Social Security numbers. Be especially suspicious of requests for passwords, MFA verification codes, gift card purchases, wire transfers or immediate payments.

Be careful with websites
Be suspicious of requests to visit a website, particularly to fill out a form or download software.

Protect your computer
If you are asked to access anything on your computer, beware! Do not download software, give the caller access to your computer or modify systems files in any way. Scammers may claim they need remote access to your device to fix a problem, issue a refund or secure your account. Never grant remote access unless you initiated contact with a trusted technical support provider.

Hang up
When in doubt, hang up the phone and do not accept future calls from the number.

Slow down and verify
Many smishing and vishing attacks create a sense of urgency to pressure you into acting before thinking. If something feels unusual, take a moment to verify the request through a trusted phone number, website or other independent communication channel.