In recent days, a new wave of phishing attacks has emerged, that is, attempts to steal bank details through a simple SMS. Victims receive a message from an unknown number, in the name of Santander Totta, BIC or Montepio, requesting urgent action from the user.

Which SMS messages are being used?

Different messages have been used, in the name of several banks:

• Montepio

In this case, a message has been sent stating that the customer's access is "inactive" and that "mandatory enrolment in SMSCODE" is required, followed by a link to a fake page.

• Banco BIC

In this version, the user is faced with a message requesting a "transfer confirmation" for 305 euros or 310 euros, followed by the date and the fake link to "validate the transaction".

• Santander Totta

In the SMS in the name of Santander, an  "Inactive Access" warning appears, followed by a link to a fake website.

I received the SMS. What should I do?

If you have received an SMS similar to those described above, you should not click on the link suggested in the message. If you have already done so and entered your login details on the fake website, you may have been the victim of fraud.

In this situation, you are advised to contact your bank and the relevant authorities. You should also check your account balance and whether there have been any suspicious transactions. Even if no transaction has been made yet, one could happen at any time. Another step you should take is to change the login details for your online account, thereby preventing access by third parties.

How does this attack work?

This phishing attack uses the operators' messaging service to send the fraudulent link to the user. In practice, each bank's address is masked by a fraudulent service which, in the case of the Montepio SMS, is "montepio.jelastic.regruhosting.ru".

What is phishing?

Phishing is one of the most frequent forms of online banking fraud and is usually carried out by e-mail. It occurs when a hacker poses as an institution or company and, through e-mail messages, phone calls or mobile text messages, tries to persuade a bank customer to disclose personal information, such as passwords and bank account numbers.

What precautions should I take?

To avoid falling victim to phishing attacks, you should take some steps such as:

• Avoid accessing your bank account through public internet networks.
• Protect your device with anti-virus, anti-spyware and firewall software.
• Make sure the applications that protect your device are kept up to date.
• Do not use obvious passwords such as 123456, "password" or your date of birth. Ideally, your password should be made up of lower case letters, upper case letters, special characters and numbers.
• You should avoid opening attachments from e-mails whose origin you do not know. This is one of the main sources of phishing and ransomware attacks.

Written by:
Openlimits

Tell us what you think