Smishing Scams: How Fake Text Messages Threaten Your Credit and Identity

Highlights

• Smishing uses urgent, deceptive text messages to trick you into clicking malicious links designed to steal personal and financial information.

• Falling for these scams can lead to compromised login credentials, unauthorized financial transactions, and full-scale identity theft.

• Help protect your identity by never clicking unexpected links, verifying alerts through official apps or websites, and regularly monitoring your credit reports for suspicious activity.

Your phone buzzes with a quick text notification. It looks like an urgent alert from your bank about a locked account, or a note from a courier service about a missing delivery address. You tap the link to fix the issue and in a matter of seconds, you might have handed your personal details over to a scammer.

This tactic is known as smishing, or SMS phishing. 

What Is Smishing and How Does It Work?

Smishing is a type of cyberattack where fraudsters send fake text messages (also known as SMS messages) to trick you into sharing personal or financial information.

Scammers use social engineering — psychological tricks that play on urgency, fear, or curiosity — to get you to act before you stop and think. And to make these texts look real, criminals often use caller ID spoofing software.

The danger lies in the link in the message. Clicking that link brings you to a spoofed website designed to mirror a legitimate login page, where you’re asked to type in passwords, bank details, or your social insurance number (SIN). 

Common Fake Text Scams Targeting Canadians

Cybercriminals constantly adapt their messaging to fit daily routines. Here are three common smishing techniques reported to the Canadian Anti-Fraud Centre:

1. Delivery Scams

You get a text claiming a parcel from a postal or courier service couldn’t be delivered because of an incomplete address or an unpaid fee. The link takes you to a fake form asking for your home address and credit card details to pay the balance.

2. Bank Fraud Alerts

A message warns that your bank account is frozen due to suspicious activity. It urges you to tap a link immediately to verify your identity or reverse a charge. The fake page captures your online banking username, password, and security answers.

3. Bogus Payouts and Fines

These texts claim you have an unexpected refund from, or fine owing to, the Canada Revenue Agency (CRA). The text might also claim you have an Interac e-Transfer payout or a balance due on a highway toll. The link asks for your banking details or SIN to process the money.

(Note: Legitimate government agencies and financial institutions in Canada, including Equifax, will never send text messages with links asking for sensitive personal or financial information.)

How Smishing Leads to Identity Theft and Credit Fraud

A single tap on a bad link is often the entry point for financial fraud and identity theft that can have serious and far-reaching consequences. Some of these consequences include:

• Exposed credentials: When you enter passwords on a fake site, scammers steal your login information. If you use the same password across multiple websites, they can gain access to your email, social media, and online shopping accounts.

• Financial exploitation: With access to your bank portal, fraudsters can transfer funds, change your contact details, or drain your savings before you notice anything is wrong.

• Credit fraud: If a scammer collects your full name, date of birth, home address, and SIN, they have everything they need to impersonate you. They can apply for new credit cards, personal loans, or cellphone plans in your name. 

What to Do If You Clicked a Suspicious Link

If you clicked a link or shared personal details, taking fast, clear steps can help limit the damage:

• Disconnect your device immediately: Turn off your phone’s Wi-Fi and mobile data. If a link downloaded malicious software, disconnecting your device stops it from sending your data to the scammer.

• Change your passwords: Using a separate, secure device, update passwords for any compromised accounts. If you reuse that password elsewhere, update those accounts too.

• Contact your bank and credit card issuers: Call the phone number listed on the back of your debit or credit card. Let them know your credentials or card details may be exposed so they can block your card and monitor for unauthorized activity.

• Place a fraud alert on your credit report: Contact credit bureaus like Equifax Canada to place a fraud alert on your credit report. This tells potential lenders to take extra steps to verify your identity before opening any new accounts in your name.

• Report the message: Forward the suspicious text to 7726 (SPAM). This lets your mobile provider block future messages from that number. You should also report the scam to the Canadian Anti-Fraud Centre and your local police.

Simple Habits to Help Protect Yourself

• Pause before you tap: Never click links in unexpected text messages.

• Go directly to the source: If a text says your account is locked, open your browser or official app independently to check your status.

• Don’t reply to spam: Responding to a scam text — even texting “STOP” — confirms that your mobile number is active, which can lead to more messages.

• Check your credit reports and consider credit monitoring: Reviewing your credit reports regularly helps you spot unknown accounts or inquiries early, before they impact your credit score.

• Get an identity theft protection product: Equifax Complete™ Protection has multiple layers of defence to help protect your identity, including device protection that flags malicious messages and blocks dangerous websites.