Smishing Is SMS Phishing

SMS phishing, or smishing, example image asking for an MFA code — If you get a text asking for your MFA code, it’s a scam!

When a scammer sends you a text, it’s called “smishing” for “SMS phishing”.

A recent phishing email campaign to the MSVU community linked to a web form that asked for an email address, password, and cell phone number.

The scammers then used this information to log into the Microsoft 365 account, which triggered a multifactor authentication (MFA) text message to be sent. The scammer then texts asking for the MFA code that Microsoft 365 sent as shown.

With the password and the MFA code, the scammers can log into your Mount account.

IT&S will never text you asking for your MFA codes. Your MFA codes are for your eyes only, so never share them with anyone other than the Microsoft Authenticator App.

Please report suspicious SMS texts to phishing@msvu.ca.