Friend or Foe: An Investigation into Recipient Identification of SMS-Based Phishing

Abstract

Short Message Service (SMS) messaging plays a key role in many people's lives, allowing communication between friends, family and businesses through the convenient use of a mobile phone. At the same time, criminals are able to utilise this technology to their own benefit, such as by sending phishing messages that convince their victims into sharing sensitive information or installing dangerous software on their devices. Indeed, Proofpoint's State of the Phish report found 81% of surveyed US organisations had faced smishing attackswhich is a type phishing attack via SMS message in 2020. Although phishing is well studied, the amount of research in SMS-based phishing is somewhat limited. Therefore, this study addresses the lack of SMS-based phishing insight, investigating which techniques/tactics are used by malicious senders and honest recipients to disguise/identify SMS-based phishing. By using an online questionnaire, a total of 576 participants' options upon 20 text messages (10 genuine and 10 phishing) were gathered. The result shows 73.4% of the SMS messages were categorised correctly; also a number of factors such as shortened URLs, inconsistent metadata/content, urgency cue, and age play a positive role in identifying phishing attacks.Keywords. short message service (SMS), phishing, text message, mobile phishing Literature ReviewThis literature review explores the techniques and tactics used by attackers when constructing SMS phishing messages and external factors that influence the capability of recipients to detect phishing.

Smishing Strategy Dynamics and Evolving Botnet Activities in Japan

“…Smishing, a compound word of SMS and phishing, is an attack in which SMS messages are sent to mobile device users to direct them to a website asking for personal information. This attack exploits human instincts such as fear and stress [48], [49]. For example, an attacker impersonates a trusted sender, such as a bank, to send important messages such as a notice that personal information has been stolen.…”

COVID-19 and Global Increases in Cybersecurity Attacks: Review of Possible Adverse Artificial Intelligence Attacks

“…Numerous scams and phishing attacks are the most prevalent and effective attacks during the pandemic. Phishing attacks have a success rate of over 30 percent [28].It is particularly concerning because attackers just require a low percentage of clicks to generate revenue or accomplish other objectives. Consequently, sending millions of emails to victims pleading for financial assistance from the government, their employers, banks and other sources will result in immediate and large rewards.…”

Who Gets Caught in the Web of Lies?: Understanding Susceptibility to Phishing Emails, Fake News Headlines, and Scam Text Messages

“…Additionally, some research has suggested that younger adults may be more vulnerable than their older adult counterparts (e.g., Sarno et al, 2020; Sheng et al, 2011). Interestingly, younger age has also been linked to an increased vulnerability to text attacks (Clasen et al, 2021) and younger adults have been reported to believe false information more than older adults (Buchanan, 2020; Rauwolf, 2022; Vijaykumar et al, 2021). However, older adults have been found to share more false information online than any other age group (Allcott & Gentzkow, 2017; Brashier & Schacter, 2020; Schaewitz et al, 2020).…”