Smishing Incident Response Checklist for Refugee Resettlement Health Programs

This checklist guides refugee resettlement health programs through rapid, coordinated response to text-message phishing. Use it to strengthen SMS phishing detection, protect patient information, and maintain service continuity when mobile devices or staff are targeted.

Smishing Identification

Early warning signs

• Unexpected texts claiming to be from leadership, EHR vendors, pharmacies, or benefits portals, especially those demanding urgent action or secrecy.
• Misspelled sender names, short codes you do not use, or local-looking numbers that change between messages.
• Links that mask destinations, use lookalike domains, or prompt logins, MFA codes, or payment details.
• Messages in unusual language tone, machine-translated phrasing, or languages mismatched to your staff roster.
• Attachments or prompts to install apps or configuration profiles on Android or iOS devices.

Train frontline staff, case managers, interpreters, and volunteers to pause before tapping links, and to route suspicious texts to a central SMS phishing detection mailbox or reporting channel.

Immediate triage questions

• Who received the message and on what device (corporate, BYOD, feature phone)?
• Was any link clicked, app installed, credential entered, or code shared?
• Which accounts could be affected (email, EHR, benefits, finance, messaging)?
• When did it occur, and are multiple staff or patients reporting similar texts?
• What data might be exposed (contact lists, messages, documents)?

Evidence preservation

Preserve the message and all artifacts before taking other action. Do not delete the text or reset the device until instructed by IT/security.

• Capture screenshots of the full message, sender number, link preview, and timestamps.
• Record the sender’s number, message body, and any links in your incident form.
• If a site was visited, capture the URL as displayed and note what was entered.
• Keep the device powered but isolated; avoid further interaction with the message.

Incident Reporting

Activate your incident escalation protocol as soon as smishing is suspected. Centralized reporting speeds containment and reduces duplicate effort.

Who to notify and in what order

• Direct supervisor and designated security/IT lead.
• Privacy/compliance officer if patient or personnel data could be at risk.
• Clinic/program leadership for operational awareness and resource coordination.

What to include in the report

• Recipient name/role, device type, and ownership (corporate vs. BYOD).
• Screenshots, sender number, links, and time of receipt.
• Any actions taken (clicked, credentials entered, app installed).
• Initial scope (others targeted, repeated messages, patient involvement).

Timeframes and thresholds

Report immediately for any credential entry, app install, or financial/patient-care implication. Escalate within the hour for widespread targeting, leadership impersonation, or suspected account compromise.

Initial Containment

Move quickly to isolate risk while maintaining critical services. Follow a documented device isolation procedure to prevent further spread or data loss.

Device containment steps

• Place the device in airplane mode; keep it powered on to preserve volatile evidence.
• Disable Wi‑Fi, Bluetooth, and hotspot; remove unknown configuration profiles.
• If managed, quarantine via MDM; if BYOD, provide on-site guidance and capture consent for inspection.
• Block the sender number across corporate messaging tools where feasible.

Account and session containment

• From a known-clean device, force sign-out of cloud sessions and revoke tokens for impacted accounts.
• Reset passwords and require MFA re-enrollment if any credential exposure is suspected.
• Temporarily suspend privileged access until investigation clarifies scope.

Network safeguards

• Enable URL filtering and DNS sinkholing for known malicious domains.
• Flag smishing domains and numbers in your email/SMS gateways to prevent further delivery.

Communication to Stakeholders

Use a structured stakeholder notification process to inform the right people with the right message at the right time—without spreading panic or tipping off adversaries.

Internal notifications

• Brief staff on what happened, what to avoid, and how to report similar texts.
• Provide a single authoritative update channel (e.g., intranet notice or all-staff email).
• Share approved screenshots of the smish for quick recognition.

External and community communications

• Notify partner clinics, interpreters, and community health workers if they could be targeted.
• If patient outreach is required, send clear, multilingual guidance on spotting fraudulent texts.
• Avoid technical detail that could aid copycat attacks; focus on protective actions.

Message content guidelines

• Do: instruct recipients not to click links or share codes; offer a verified call-back number.
• Don’t: forward the malicious text; speculate about root cause before investigation concludes.

Investigation and Analysis

Conduct focused digital forensics analysis to determine entry point, scope, and impact, and to guide remediation. Document every step and preserve chain of custody.

Timeline and scoping

• Reconstruct events from first report to latest observed activity.
• Correlate SMS timestamps with authentication logs, EHR access, email, MDM, and VPN records.
• Identify common denominators: sender numbers, domains, themes, languages, or targeted roles.

Technical analysis

• Analyze URLs in a safe sandbox; capture redirects, hosting, and certificate details.
• Inspect devices for malicious apps, profiles, or side-loaded APKs; compute hashes and note permissions.
• Review account audit trails for anomalous logins, MFA prompts, and privilege use.
• Collect indicators of compromise (IOCs) and update blocklists accordingly.

Impact assessment

• Determine whether credentials, contacts, or messages were exfiltrated.
• Classify severity based on affected roles, data sensitivity, and operational disruption.
• Decide on notifications or additional controls required by policy or regulation.

Remediation Steps

Apply corrective actions to eradicate threats and reduce the chance of recurrence. Prioritize malware removal, credential hygiene, and system hardening.

Device remediation

• Uninstall malicious apps and remove rogue configuration profiles; verify no persistence remains.
• Run mobile security scans; if compromise is suspected, perform a full factory reset and MDM re-enrollment.
• Update OS and apps to current versions; disable side-loading and unknown sources.

Account and system remediation

• Reset passwords for affected accounts; enforce strong MFA and reissue recovery methods.
• Invalidate OAuth tokens and app passwords; rotate API keys and service credentials if exposed.
• Harden login flows with conditional access and geo/behavioral risk rules.

Operational follow-through

• Remove malicious domains/numbers from delivery paths and update filtering rules.
• Document lessons learned; update playbooks and training materials.
• Verify business services (scheduling, messaging, EHR access) operate normally post-remediation.

Prevention Measures

Strengthen defenses with layered controls, clear processes, and routine practice. Align technology with practical access control policies that fit mobile-first fieldwork.

People and process

• Run quarterly role-based training with smishing simulations for staff, contractors, and volunteers.
• Publish an easy reporting path (forward to a short address, hotline, or MDM button) and celebrate near-miss reports.
• Standardize outbound messaging practices so staff and patients know what your program will—and will not—send by SMS.

Technology controls

• Deploy mobile threat defense, MDM, and phishing-resistant MFA; prefer authenticator apps or passkeys over SMS codes.
• Enable SMS and URL filtering where supported; block app side-loading and enforce device encryption and screen locks.
• Implement data loss prevention for contact exports and message forwarding.

Governance and access

• Adopt least privilege and periodic access reviews; document exceptions and time-box elevated roles.
• Define and test an incident escalation protocol with on-call coverage and clear handoffs.
• Review and enforce access control policies for EHR, email, cloud storage, and messaging platforms.

Summary

Effective smishing defense blends rapid reporting, disciplined containment, thorough analysis, and targeted remediation. By standardizing procedures and reinforcing staff awareness, you reduce risk to patients, protect data, and keep vital services running.

FAQs

What are the first steps in responding to a smishing attack?

Preserve the message, stop interaction, and report it immediately through your incident escalation protocol. Isolate the device (airplane mode), reset potentially exposed credentials from a clean device, and notify security/privacy leads so containment and investigation can begin without delay.

How can refugee health programs prevent smishing incidents?

Combine frequent, role-based training with clear outbound messaging standards, strong MFA, MDM on staff devices, and practical access control policies. Run smishing simulations, maintain updated blocklists, and rehearse your playbook so staff recognize and report suspicious texts quickly.

What actions should be taken after detecting a smishing message?

Capture screenshots and sender details, isolate the device, and escalate to IT/security. Conduct digital forensics analysis as needed, perform malware removal or device reset if compromise is suspected, reset credentials and revoke tokens, and communicate guidance to stakeholders to prevent further harm.