2.2Smishing & vishing (fraudulent SMS & calls)
The essentials in 30 seconds
- The displayed number proves nothing: display spoofing shows the bank's real number — a number does not authenticate anyone.
- No bank asks for codes or approvals by phone: an “advisor” asking for a code = fraud — a received code is never shared.
- Controlled callback: hang up then call back the official number yourself — don't judge under pressure, hang up.
Threaded mini-case — Karim gets a call from a “fake advisor”
Continuing the level: Karim receives a call displaying his bank's number. A very professional “advisor” warns him of ongoing fraudulent transactions and asks him to approve their cancellation with a code received by SMS. Karim recognizes the fake-bank-advisor scenario: instead of judging under pressure, he applies his protocol — “I'll hang up and call back myself” — then calls the official number: no problem on his account. The fraudulent SMS received the day before goes to 33700.
Teaching model: the quoted lines illustrate the scenario to recognize, not attack instructions.
1. Phishing beyond email
Phishing does not only come by email. Smishing (fraudulent SMS) and vishing (fraudulent calls) are growing fast — often more effective because the channel feels less suspicious. Typical patterns: fake delivery SMS, fake bank SMS, fake advisors (bank, tech support, telecom operator). Karim stacked both in 48 hours: one SMS, then the call.
2. The displayed number proves nothing
Display spoofing shows the bank's REAL number: the displayed number proves nothing anymore. Golden rule: no bank ever has transactions approved or codes shared by phone — nor any “security” transfer. And knowing personal details (name, bank) proves nothing either: data leaks and public information make scenarios credible.
3. The universal defense
The controlled callback: hang up and call back the official number yourself (back of the card, official site). On SMS: never the link; open the official app yourself to check. Forward fraudulent SMS to 33700. This protocol resists even the most convincing fraudsters, because it does not depend on judgment under pressure.
🔎 Concrete example — 🔎 Concrete example — The sentence that ends 100% of frauds
Karim's standard reply, said politely (teaching model):
“Thank you, I'll hang up and call the branch back myself.”
SMS: do not click; open the official app/site yourself.
Forward the fraudulent SMS to 33700.Takeaway: a protocol that resists the most convincing fraudsters.
Lesson: it does not depend on your judgment under pressure.
Section vocabulary
- Smishing
- Phishing by SMS: fake parcel, fake bank alert or fake account, with a trapped link.
Simple example: Karim receives a fake delivery SMS with a link to click.
What it is not: an expected SMS (tracking code for a real parcel) verified in the official app.
Reflex: SMS + link = never the link, check in the official app.
- Vishing
- Phishing by phone: a very professional “advisor” or “technician” guides the victim toward fraud.
Simple example: Karim's “advisor” pressures him to approve transactions by phone.
What it is not: a call you placed yourself to your bank's official number.
Reflex: unexpected call + action request = hang up, call back yourself.
- Fake bank advisor
- The classic scenario: alleged ongoing fraudulent transactions, and the victim “approves the cancellation” — actually approving the fraudster's transfers.
Simple example: “Give me the SMS code to cancel”: Karim refuses and hangs up.
What it is not: a real bank inviting you to visit a branch or use the app.
Reflex: SMS code + call = fraud, always.
- Display spoofing
- Technique showing a fake caller number — including the bank's real number: the displayed number proves nothing anymore.
Simple example: Karim's phone shows his bank's genuine number… without it being them.
What it is not: the number you dial yourself from an official source.
Reflex: never authenticate a caller by the displayed number.
- Controlled callback
- The universal defense: hang up and call back the official number yourself (back of bank card, official site).
Simple example: Karim calls his bank on the known number: no problem on his account.
What it is not: staying on the line and “checking” with the caller themselves.
Reflex: prepare the sentence in advance to say it without hesitating.
In practice — In practice — Setting up the anti-vishing protocol
- Memorize the golden rule: your bank will NEVER ask you by phone to approve a transaction, share an SMS code or make a “security” transfer.
- Script your standard reply: “Thank you, I'll hang up and call the branch back myself” — said politely, it ends 100% of frauds.
- On SMS: never click the link; open the official app or site concerned yourself to check.
- Forward fraudulent SMS to 33700 (official SMS-spam reporting platform).
Ready-to-say script — answering a suspicious call (15 s)
“Thank you for warning me. As a rule, I never approve anything by phone: I'll hang up and call my bank back myself on the official number. Have a nice day.”
Say politely then really hang up; then call back the known official number (card back, official site).
Copy-paste template — anti-vishing protocol
GOLDEN RULE: bank = never a code or approval by phone.
SUSPICIOUS CALL → say the sentence → hang up → call back the official no.: _______________
SUSPICIOUS SMS → do not click → check in the official app → forward to 33700.
CODE SHARED BY MISTAKE → call the bank at once (official no.) + change passwords + keep evidence.Fake tech support
“Technician” asking for remote access: same protocol — hang up, call support back on the official number.
SME in Algeria
Karim saves his bank's official number in favorites to call back without searching under pressure.
Parcel-delivery SMS
Fake parcel: do not click; track the parcel in the carrier's app or on the self-typed site.
Urgent relative / colleague
Urgent money request by message: call the person back on their known number first.
✓ Best practices
- Always hang up and call back the official number yourself.
- Never click an SMS link: open the official app.
- Report fraudulent SMS to 33700.
✗ Common pitfalls
- Taking the displayed number as proof (spoofing).
- Giving an SMS code to an “advisor”.
- Approving a “security” transaction by phone.
Key takeaways
- The displayed number (phone or SMS) can be spoofed: it is no proof.
- No bank has transactions approved or codes shared by phone.
- The universal defense: hang up, call back the official number yourself.
- Suspicious SMS → never the link; check via the official app; report to 33700.
48h Challenge - apply tomorrow
Save your bank's official number in favorites and rehearse the hang-up sentence aloud 3 times. Forward any fraudulent SMS received this week to 33700.
- I can recite the hang-up sentence without hesitating.
- I can explain why the displayed number proves nothing.
- I have the official number in favorites and I report to 33700.
Frequently asked questions
The fake advisor knew my name and my bank: how?
Data leaks and OSINT: this information circulates and makes the scenario credible. That is precisely why knowing personal details must NEVER serve as proof of a caller's identity.
I gave an SMS code to an “advisor”: what now?
Immediately call your real bank (official number) to block, stop payments if needed, change your banking passwords, keep the evidence and file a complaint. Speed limits the damage (see also 5.1).
Karim is on the phone with an “advisor” demanding his SMS code. What does he do?