In this interview, identity‑theft expert Robert Siciliano of McAfee explains two prevalent mobile‑focused scams: smishing (SMS phishing) and a Facebook photo‑tag email spoof. He describes how smishing messages mimic legitimate entities and contain malicious links that can install malware or harvest personal data such as Social Security numbers. Siciliano advises users never to click links in unsolicited texts, to install mobile security software, and to treat mobile devices like PCs in terms of protection. He also debunks the myth of a specific “Do Not Call” registry for mobile phones. The conversation then shifts to a Facebook‑related scam where attackers copy Facebook’s photo‑tag notification email, embed a zip file that installs a virus, and lure victims to click. He recommends manually logging into Facebook via a trusted URL or password manager rather than following email links. The segment closes with a recap of these threats and practical steps to stay safe.
Chapters
Well, have you ever heard of smishing? It's a new scam that everyone who has one of these, a cell phone, should know about, and we'll talk with our security expert about that and a Facebook scam up next. Two items you use that could leave you a target of scammers: your cell phone and your Facebook page. So what are they, and what do you need to know to protect yourself? Well, here to explain from our Beacon Hill studio, identity theft expert Robert Siciliano with McAfee. Robert, thanks for being with us.
Thank you.
So we've heard about phishing, those spam There's spam emails, of course, that try to get you to divulge your personal information, and now there's smishing. What's the deal with that?
So smishing is when you receive an SMS text, so a short message service text message, that looks like it's coming from a legitimate entity via your mobile phone. Now, generally there is a link within that text that is a phish, so it's designed to get you to click on it, eventually to get you to a website to either download something or to divulge personal information. Personal information.
Like your Social Security number, your birthdate. So what can you do to protect yourself and your data plan too? You don't wanna be getting text messages that you don't want.
Yeah, so first thing is whenever you receive a text message from an entity in which you trust or even somebody that you don't trust, I recommend not clicking on links in the body of a text. 'Cause when you click on that link, you could either be downloading something onto your mobile which will infect it, or essentially you'll be going to a website to enter your personal information. So unless you're absolutely 100% sure, just don't click the link. In addition to that, you should have a mobile security product on your phone, just like you would have antivirus on a PC. You have to also have it on an Android phone as well.
So that will protect you from getting the emails in the first place?
It'll protect your phone from being compromised by a virus if in fact you did click a link that was infected.
Gotcha. Is that Do Not Call number still in effect that you can, can call now to not get those kinds of unwanted cell phone text messages?
So it is an urban myth that there is a Do Not Call registry for mobile phones. Uh, you can enter your mobile phone into donotcall.gov, but there's no specific registry for mobile phones.
Interesting. Okay, let's move on to Facebook now. We've all been tagged in photos on the social networking site, and now we need to be on the lookout for some sort of photo notification scam that could be a virus? Tell us about this.
So we all receive an email from Facebook letting us know that our friend tagged us in a photo. That there might be a new notification and so forth. And generally when we get those, we click on it, which brings us to Facebook to look at that tag or that photo or whatever. Now what bad guys are doing is they're using that exact same email template and they're sending out emails that look like they're coming from Facebook designed to get you to click. When you click, you open up a zip file. That zip file essentially is a virus that downloads onto your machine. So anytime you ever get an email that looks like it's coming from Facebook, even if it is from Facebook, I recommend manually logging into Facebook via your password manager, or just type in facebook.com and sign in, and that way you know you're going to Facebook.
Very good advice. All right, Robert Siciliano, thanks so much for keeping us abreast of all the latest scams we need to be watching out for.
