(WSPA) – If you are sick of scam texts and think you would never fall for one, this sobering statistic may surprise you.
The Federal Trade Commission said Americans lost $330 million from smishing scams in 2022, double the losses from 2021 and five times the amount from 2018.
There is no question more people are losing a lot more money, so it’s more important than ever for you to recognize the signs.
In this 7NEWS Consumer Exclusive, we looked into how to spot smishing scams and spoke to a North Carolina man who warns what can happen if you reply.
What is smishing and why is it so effective?
Smishing is the fraudulent practice of sending a text message (SMS) claiming to be from a reputable source, like a company, doctor’s office or government agency, to con recipients.
It is the text equivalent of phishing scams. Also, like phishing, smishing is a way for scammers to trick targets into either revealing personal information like passwords, credit cards or clicking on a malicious link.
It is the text version of phishing, which applies to emails.
Why are they so effective?
98% of all texts are read and 45% get a reply. That is one big reason scammers are increasingly targeting your phone.
Ryan Kouvolo, with CMIT Solutions in Greenville, said like phishing scams, smishing is a way for scammers to steal money, gather private information or trick recipients into clicking a link that downloads malware which can work in the background without you knowing.
“The reason why this is successful is phones don’t have the same level of security that your computer would,” Kouvolo said.
He advises mobile phone users to install an anti-virus that consistently scans the device like Malwarebytes which offers free protection.
Still, that won’t stop smishing scams that use social engineering to turn the victim into their pawn.
The golden rule: If you get a text from someone you don’t know, even if it’s a company you do business with, don’t respond, but instead call that company directly.
What can happen if you do respond
Marcos Meilan is a business owner in North Carolina who was targeted on a busy day with an alarming text.
It was an urgent fraud alert claiming to be from his bank saying they “detected suspicious transfer activity.”
It asked him to confirm a $7,500 Zelle payment. When he replied NO, he got a phone call from a number that came up as his bank, Bank of America.
“He was super nice and super smooth and trying to help me,” Meilan, referring to the caller, said. “Meanwhile he wasn’t helping me he was trying to take all the money out of my account. That’s all the money I had in my business checking account”
The caller told him he was reversing the charges but instead tricked him into sending two Zelle payments of $7,500–$15,000 total.
Top 5 most convincing scam texts
Government data showed the most effective scam texts have one thing in common; they impersonate well-known companies.
- The number one smishing scam is just what hit Meilan: Bogus bank fraud alerts
Rounding out the top 5:
- Bogus-free gifts from your mobile carrier
- Fake package delivery problems
- Phony job offers
- Fake Amazon security alerts
How victims (and lawmakers) say Zelle is making smishing scams easier
Meilan showed us how the scammers had spoofed the real Bank of America number.
However, what really also put him at risk was his bank’s use of the quick money transfer service Zelle.
The service was fairly recently added to his banking page, and many others.
This means there is no app download required, nor any need to enter banking information. Those are two steps that would make many bank fraud scam text targets think twice.
Instead, Zelle merely requires “a few simple steps to enroll.”
Once enrolled, the bank customer doesn’t need a name or a bank routing number of the recipient, but merely a phone number or email address to complete the transaction.
“I didn’t ask for Zelle on my bank account, so somebody has to be responsible, they just can’t point the finger to the little guy that has no idea,” Meilan said.
Still, Meilan got this letter from Bank of America denying his fraud claim because he was the one to complete the transaction on “a device consistent with previous activity.”
Banks rarely reimburse losses for clients who send money, even when they are tricked. Now, all because of a text, he is out $15,000.
That number is important because it happens to be the exact Zelle transaction daily limit for his type of account, business account.
Despite hitting that daily limit to the cent, nothing was flagged, not with Zelle nor Bank of America, and the transaction was allowed to go through.
Only after Meilan realized he was scammed did he see how easy Zelle made it for the scammers to trick someone like him who is not familiar with the quick wire transfer service.
“It’s super easy. If you know how to use it, it’s a perfect scam,” he said.
Unfortunately for Meilan and thousands like him, Zelle does not offer protection if the user is the one to make the transaction, even if they are tricked into doing it.
The pattern, lack of protections and growing number of victims is so concerning, a group of US Senators filed a document in March of 2023 with the Nation’s leading financial oversight agencies urging them to take action to protect consumers.
It raises concerns about Zelle because they are under “no obligation to make their customers whole again” when fraudsters use it to steal money.
7NEWS reached out to both Zelle and Bank of America. Both companies said they educate customers about how to avoid scams.
Bank of America refuted that the easy access to Zelle on the account pages of bank customers put them at risk.
The company told 7NEWS “The presence of Zelle doesn’t put customers at risk. Customers have to enroll in Zelle before they can use it to send or receive money.”
The parent company of Zelle, Early Warning Services, tells 7News “Our work reflects that more than 99.9% of Zelle® transactions have been completed without a report of fraud or scam,” citing its efforts to warn customers about fraud.
The company recommends:
- Regardless of urgency, never provide your personal information, account numbers or other sensitive information that could give anyone access to your financials
- If a suspicious individual contacts you, don’t be afraid to refer to the official website of the organization they claim to represent and contact the organization through the information listed on their official website; this includes not clicking on a text or email link or responding to a call or text
- Only send money to those you know and trust. Money moves fast with Zelle®, so treat it like cash–once you send it, there’s no purchase protection
Neither Bank of America nor Zelle would reimburse Meilan the lost funds, nor would they inform him where the money went.
All he had was a 10-digit number that was required to transfer the number.
Meilan, still thinking it was Bank of America customer service on the line, didn’t realize those digits were a phone number.
The scammers had tricked him into thinking it was a transaction number needed to reverse the “bogus” charge.
He said he has had to borrow funds to keep his business afloat.
As he struggles to regroup, he hopes by speaking out he can save others from falling victim.
