Alex Hamerstone, the Advisory Solutions Director at TrustedSec, said the first type of smishing is when thieves do research and target a specific person. The second is a “spray and pray” approach where thieves send messages to tens of thousands of numbers using automated systems.

Usually, some of those people take the bait because thieves claim the message is from a cell phone provider, or another trusted company, or they spoof the number to make it look like it’s coming from the potential victim’s own phone.

“Oftentimes, it’ll take you to a website that’s fake. It’ll look very real. It’ll look like the website of whoever they’re purporting to be and it will try to get you to enter your information. So your username, your password. Other financial information, and then they’ll take that and use it in various ways,” said Hamerstone.