Commission checking reports of smishing using contact tracing forms

MANILA, Philippines — The National Privacy Commission (NPC) said it is looking into reports that information in contact tracing and other forms aimed at monitoring the spread of COVID-19 have been used by fraudsters to target people for smashing — a variation of phishing through which mobile phone users are tricked into sharing private information.

In a statement on Tuesday, the NPC advised mobile phone users to be alert to messages which redirect them to dubious websites, which they might click inadvertently.
The NPC said these sites may steal users’ personal data or introduce mobile malware, among other schemes.

The agency will investigate if the information obtained by smishing indeed came from contact tracing and health declaration forms, said Roren Chin, who heads the NPC’s public information and assistance division.

Safety steps

Smishing, as defined by the Oxford Languages Dictionary through a Google search, is “the fraudulent practice of sending text messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords or credit card numbers.”

The word is a combination of SMS (short message service) and phishing.

The NPC said smishing can be used in online shopping and deliveries to trick unsuspecting victims who expect a product they purchased online.

NPC Commissioner Raymund Liboro said in the statement “One of the best ways users can arm themselves against smishing attacks is to be aware of this kind of manipulation. Scrutinize the text messages you receive, especially if they come from an unknown number and request information about you.”

The statement also recommended some steps the public can take to protect themselves—such as avoiding clicking links that direct them to services they didn’t sign up for and disabling the link previews in their SMS app.

These links “require an action from you, such as filling out online forms with your personal or financial information,” the NPC said.

While contact tracing and health declaration forms are crucial to the government’s pandemic response, including the tracing of COVID-19 cases, these forms also present a dilemma in terms of the need to observe privacy rules.

Liboro said the NPC consulted with the Department of Health (DOH) in May last year to ensure that guidelines on contact tracing are consistent with the Data Privacy Act of 2012.

“We believe successful contact tracing can only happen when there’s mutual trust between public health authorities and the citizenry. [But] the public must [still] give accurate information for contact tracing to be effective,” Liboro said.