How To Protect Yourself Against Text Spoofing
Text-message scams, often called smishing (SMS + phishing), are one of the fastest-growing attack methods against employees. Unlike email, SMS has almost no built-in authentication, so an attacker can make a message appear to come from your bank, your carrier, a delivery service, or even your own CEO. This article explains how spoofing works, how to spot it, and what to do when a suspicious text arrives..
Why text messages are so easy to fake
Email has protective standards like SPF, DKIM, and DMARC that let receiving servers verify a sender. SMS has no equivalent. A few factors make spoofing cheap and effective:
Sender ID is not verified. Bulk-messaging gateways let a sender set an arbitrary "from" name or number. The name shown on your screen is a label, not proof.
Thread merging. If an attacker spoofs a short code your bank already uses, the fake message can land inside the same conversation thread as legitimate alerts, which makes it look authentic.
Small screens hide clues. Mobile browsers truncate URLs, and link shorteners hide the real destination entirely.
Urgency works. Texts are read within minutes, usually while the recipient is distracted. Those are exactly the conditions attackers want.
A message appearing in an existing thread from a trusted sender is not evidence that it is legitimate. Judge every message on its own content.
The scams you are most likely to see
Executive or manager impersonation
A text claiming to be from your CEO, controller, or direct manager, usually from an unknown number, asking whether you are available, then escalating to gift cards, an urgent wire, a vendor banking change, or a request to keep the matter quiet. Executives do not conduct financial business by surprise text.
IT or help desk impersonation
"ServerNova Support: your password expires today, verify here." Or a request to read back a multi-factor code that just arrived. Legitimate support will never ask you to supply a one-time passcode.
Delivery, toll, and DMV notices
Fake package-redelivery fees, unpaid toll balances, or license renewals with a small payment link. The dollar amount is deliberately trivial, because the goal is your card number, not the $3.95.
Bank and fraud alerts
"Did you authorize a $482 charge? Reply NO to dispute." Replying triggers a phone call from the "fraud department," which then walks you into approving a real transfer or handing over a verification code.
Wrong number and long-con approaches
A friendly "Hi, is this Sarah?" that turns into weeks of conversation and eventually an investment or cryptocurrency pitch. These are patient, human-operated fraud campaigns.
Red flags at a glance
Signal | What it looks like | Why it matters |
|---|---|---|
Unknown number, known name | "Hi, it's Mark, new phone" | Classic pretext for impersonating a colleague |
Manufactured urgency | "Respond in 30 minutes or your account closes" | Pressure is meant to prevent verification |
Shortened or mismatched link | Link shorteners, or bank-secure-verify.co instead of the real domain | Hides a credential-harvesting page |
Request for a code | "Read me the 6-digit code we just sent" | The attacker has your password and needs the second factor |
Unusual payment method | Gift cards, crypto, payment apps, prepaid debit | Irreversible and untraceable by design |
Secrecy request | "Don't mention this to anyone until it's done" | Isolates you from the people who would catch the fraud |
Odd phrasing or formatting | Missing articles, mixed currency symbols, off-brand tone | Common in mass-produced or translated campaigns |
Never share a one-time passcode with anyone. Not a caller, not a texter, not someone claiming to be from IT, your bank, or ServerNova. A legitimate organization already knows the code and has no reason to ask.
How to verify a suspicious message
Stop and separate the channel. Do not reply to the text, and do not call a number contained in it. Verify through a channel you already trust.
Use a known-good contact method. Call your colleague on the number in your company directory or Teams. For a bank, use the number printed on your card.
Inspect the link without opening it. Press and hold to preview the full URL. Look at the domain immediately before the first single slash. That is the real destination.
Check the request against normal process. Does your organization ever change vendor banking details by text? Does payroll ever request gift cards? If the answer is no, the message is fraudulent regardless of how convincing it looks.
Escalate anything financial. Payment, banking, or payroll requests received by text should go to your finance lead for out-of-band confirmation before any action.
Adopt a simple household and workplace rule: any request involving money, credentials, or codes gets verified by voice on a number you already have. One 30-second phone call defeats nearly every one of these scams.
If you already replied or clicked
Acting quickly limits the damage. Do not delete the message, since it is useful evidence.
If you entered credentials: change that password immediately from a different device, then change it anywhere else you reused it. Contact ServerNova so we can review sign-in activity and revoke active sessions.
If you approved an MFA prompt or shared a code: report it right away. Your account should be treated as compromised until sessions are revoked and MFA methods are re-registered.
If you sent money or gift cards: contact your bank or the card issuer immediately and file a report with your local police and the FBI Internet Crime Complaint Center at ic3.gov. Speed matters, because wire recalls are sometimes possible within the first 24 to 72 hours.
If you shared personal data: place a fraud alert or credit freeze with the three credit bureaus and monitor statements closely.
If it involved a work account: notify ServerNova and your manager even if you are not sure anything happened. There is no penalty for reporting, and early notice often prevents a much larger incident.
Reporting and blocking
Forward the message to 7726 (spells "SPAM"). This reports it to your mobile carrier at no charge and helps them block the sending infrastructure.
Use the built-in report option. iPhone and Android both offer "Report Junk" or "Report spam" beneath messages from unknown senders.
Block the number after reporting, though be aware that attackers rotate numbers constantly, so blocking alone is not a defense.
Report to the FTC at reportfraud.ftc.gov for consumer-targeted scams.
Report work-related attempts to ServerNova. Send a screenshot to your help desk so we can warn other users in your organization and check whether the campaign is targeting your domain more broadly.
Do not reply "STOP" to a message you believe is a scam. Legitimate marketing must honor opt-outs, but a fraudster simply learns that your number is active and monitored, which usually increases the volume of attacks.
Reduce your exposure
Turn on unknown-sender filtering. iOS: Settings > Apps > Messages > Filter Unknown Senders. Android Messages: Settings > Spam protection.
Move away from SMS-based MFA where possible. Authenticator apps, number matching, passkeys, and FIDO2 security keys are dramatically harder to intercept or trick.
Ask your carrier about port-out protection and an account PIN to defend against SIM-swap attacks.
Limit where your mobile number is published. Data brokers and breach dumps are the primary sources for targeted smishing lists.
Keep your device and messaging app updated. Several past attacks used vulnerabilities in message parsing that patches have since closed.
Save key contacts properly. When your executives, finance staff, and IT contacts are saved in your phone, a message from an unknown number claiming to be one of them is instantly suspect.
Getting help
If you receive a suspicious message referencing your company, a colleague, a vendor, or a work account, forward a screenshot to the ServerNova help desk. Include the sender's number and the date and time received. We would far rather review ten harmless messages than miss the one that mattered.