Smishing

Here are some questions to ask yourself to spot the most common smishing attacks:

1. Does the message create a sense of urgency, attempting to pressure you into taking action?
2. Is the message taking you to websites that ask for sensitive information, such as a password or your financial details?
3. Does the message sound too good to be true? Think of the iPhone reward example.
4. Does the linked website or service force you to pay using non-standard methods such as Bitcoin, gift cards, or Western Union transfers?
5. Does the message ask you for the multi-factor authentication code that was sent to your phone or generated by your banking app?
6. Does the message look like the equivalent of a “wrong number?” If so, do not respond to it or attempt to contact the sender; just delete it.

In smishing attacks, scammers often send messages imitating the BMV. These fake messages will typically inform you that you have an outstanding traffic ticket. The text then instructs you to pay a fine immediately to avoid punishment. This attack focuses on urgency to get you to give up your personal or financial information quickly, before you realize it is a scam.

Spotting and Stopping Messaging Attacks

1. Check the phone number from which the message is being sent. Is it affiliated with the Ohio BMV? Does the sender’s number match up with any of the contact information seen on the official Ohio BMV website? If not, then you should delete the message and block the sender.
    
2. These messages may contain URLs to fake websites that look like the official Ohio BMV website. Clicking on these links without first verifying that they are safe can lead to your device being infected with malware. More in-depth information on finding out if these links are malicious can be found on our malicious links webpage.
    
3. When looking at the message, is there a sense of urgency to scare you into making a quick decision? Scam messages tend to rush you into making quick decisions, creating a stressful time crunch. This tactic creates heightened vulnerability in users and increases the scammer’s rate of success.
    
4. Please share this information with anyone you can think of to help keep everyone safe from these attacks. Our team has prepared additional information about fraud recovery to help keep you safe!

Remember:

Government agencies will never contact you via text message. The Ohio BMV will never send you a text demanding payment or personal information. If you ever get an alarming message from an organization, call or email the organization back directly. Do not use the contact information provided in the message. Always go to the organization’s website and use a trusted and verifiable phone number or email. The official Ohio BMV website can be used to contact them directly.

If you get a message from an official organization that alarms you, call the organization back directly. Don’t use the phone number included in the message, use a trusted phone number instead. Such a number could be found on official documents from that company, or on their website's contact page.

Also remember that most government agencies, such as tax or law enforcement agencies or the BMV, will never contact you via text message; they will only contact you by physical mail.

If you receive a smishing attempt, there are many ways that it can be reported, though these methods depend on which device, app, and service provider you are using. Please visit our report phishing page for more information.