A text message lands on your phone. It says it’s from your utility provider: power outages are expected in your area because of wildfires, high winds, or an approaching storm. There’s a link to an outage map so you can check whether your home or office will be affected.
The timing feels right. Maybe it’s fire season, maybe the wind has been howling all week. The message looks official. So you tap the link.
That tap is exactly what the scammer was counting on. Here’s the good news: once you know how this scam works, it’s one of the easiest to beat.
How the scam works
This is a smishing scam: phishing carried out through SMS text messages. Cybercriminals send alerts that mimic the ones real utility companies use, and they time them around weather events so the warning feels urgent and credible. They’re banking on the fact that disaster-related alerts get taken at face value.
If you tap the link, one of two things happens. Either malware is quietly installed on your device, or you’re taken to a fake website designed to harvest your personal information: logins, account numbers, payment details. Either way, by the time you realize something is off, the damage is already done.
What makes this scam so effective is that it doesn’t feel like a scam at all. It feels like a public service announcement. There’s no request for money, no suspicious attachment, just a helpful-looking heads-up about something you genuinely care about. That’s exactly the point.
For businesses, the stakes are a little higher. If that text lands on a phone that’s also connected to company email, files, or banking, one tap can open a door much wider than a single device. And since these messages go out in bulk, it only takes one person on your team acting in a hurry.
How to protect yourself (and your team)
None of this requires special software or technical skill, just a few habits worth building and sharing around the office:
- Don’t tap links in unsolicited text messages, ever. Even if the sender looks familiar, the safest answer to a surprise link is no.
- Go straight to the source. If you’re genuinely concerned about an outage, open your utility provider’s official website or mobile app yourself.
- Remember how real utilities communicate. Legitimate utility companies don’t send texts with clickable links. Outage information comes through official channels.
- Watch for urgency. Fear of losing power, missing an alert, or being unprepared is the lever scammers pull to make you act before you think. A real alert doesn’t mind waiting while you verify it.
- Already tapped the link? Don’t panic. Run a security scan on your device right away and keep a close eye on your accounts for suspicious activity.
The text felt like a public service. That’s the trick. Taking ten seconds to open your utility’s app instead of tapping an unknown link is one of the simplest habits you can build, and one of the most effective. It costs you nothing, and it takes this entire category of scam off the table.
Keeping clients ahead of threats like this is part of how we approach Cybersecurity-Driven IT at Vertical IT Solutions: spotting the scams early, translating them into plain English, and making sure your team knows the play before it reaches their phones. If you’d like a quick read on where your business stands, take our free 60-second Security Score, or talk to our team and we’ll walk through it with you, no jargon required.
