Text message phishing is easy to spot once you know what to look for: the message pushes you, contains a link and asks for immediate action. To protect your small business, don’t click, don’t reply, verify another way (call a number you already know) and delete the message. These few habits stop most traps.

What is text message phishing?

It is a scam where someone pretends to be a bank, a government agency or a supplier to make you click a link or hand over information. The Canadian Centre for Cyber Security explains that these attacks rely on trust, urgency and other psychological factors. Together with the RCMP, it has also warned about increasingly sophisticated text message attacks aimed at individuals and businesses.

Why are small businesses targeted?

A small business often has few people handling security, and a single employee clicking can be enough. A phone is also something we check quickly, often between two job sites or two deliveries. What you risk: stolen access, diverted money or exposed customer data.

What are the warning signs?

In its guide on text message phishing (ITSAP.00.103), the Canadian Centre for Cyber Security describes signs to watch for:

  • an urgent message about a “blocked” or “compromised” account;
  • a shortened or suspicious link;
  • a request for a password or social insurance number;
  • an unsolicited message claiming to come from a government or financial institution.

A sender who looks familiar is not proof: addresses and numbers can be spoofed.

The 5 habits to adopt

  1. Don’t click the link and don’t reply to the message.
  2. Ask yourself whether that organization would really contact you by text.
  3. Verify another way: call the official number you already have, or open the website by typing the address yourself.
  4. Delete the suspicious message.
  5. Warn your team: a shared message protects everyone.

How do you limit the damage if someone clicked?

Act quickly, without blaming the person. Change the affected passwords, notify your financial institution if banking details were given, and turn on multi-factor authentication wherever possible. The Centre recommends avoiding text messages as an authentication method when another option exists, such as an authenticator app.

Where do you report fraud?

You can report the incident to the Canadian Anti-Fraud Centre (1-888-495-8501). The Government of Canada’s Get Cyber Safe site also offers free guides for small businesses.

Where to start this week

  • Have your team read this article and agree on a simple rule: “A pushy message gets verified first.”
  • Write down on one page what to do after an accidental click, and who to call.
  • Turn on multi-factor authentication for your email and most important tools.

At Axentra Technologies, we help small businesses centralize access and automate sensitive processes, with a free 15-minute diagnostic to take stock.