Field staff do much of their work on phones. They check schedules, approve deliveries, take photos, and chat with dispatch and vendors, all on devices that sit outside the office network and often outside company security tools. Attackers know this, and text message scams, often called smishing, target exactly that gap.
A text arrives, it looks routine, and a busy foreman who is on a ladder or in a truck taps a link without thinking. The result can be stolen credentials, a compromised account or a fraudulent payment.
Why texts work so well
- People trust text messages more than email, and read them quickly
- Phone screens hide full links and sender details
- Field staff are busy, interrupted and often multitasking
- Personal and work phones are frequently the same device
- Company email filters do not see texts at all
Lures that fit the construction and energy world
Fake delivery and logistics notices
A message claims a delivery of materials or equipment is delayed and asks the recipient to confirm an address or pay a small fee. Field staff expect deliveries, so the lure is believable.
Impersonating the boss or a coworker
A text appears to come from the owner or a project manager, asking for a quick favor: buy gift cards, send a code or approve something. The sender's number may be new, but the message says it is a temporary phone.
Fake login alerts
A text warns that your Microsoft 365, project management or payroll account has a problem and links to a lookalike login page. Entering credentials hands them to the attacker.
Payroll and benefits messages
Messages claiming a problem with direct deposit or benefits ask crew members to log in to update details. The goal is often to redirect pay to another account.
Fake safety or inspection notices
A text claims to be from an inspector, a safety office or a utility, demanding urgent action or payment.
Verification code requests
An attacker already has a password and triggers a login. A text asks, "Did you request this code? Reply with it to cancel." Sharing the code lets the attacker in.
Habits that stop most of these
- Do not tap links in unexpected texts. Go to the website or app directly instead.
- Never share verification codes. Legitimate services do not ask you to read a code back to them.
- Verify unusual requests by calling a known number. If the "boss" texts from a new number asking for money or gift cards, call the number you already have.
- Be suspicious of urgency. Pressure to act immediately is a common manipulation tactic.
- Report, then delete. Tell your supervisor or IT contact about suspicious texts so others can be warned.
What the company can do
Make reporting easy
Give crews a simple, no-blame way to report: a phone number, a shared message thread or a button in an app. People hide mistakes when they fear punishment, and delays make damage worse.
Use multi-factor authentication that resists scams
Authenticator apps with number matching or hardware keys are harder to trick than codes sent by text. Where possible, move high-risk accounts away from SMS codes.
Manage devices that touch company data
Company-owned or enrolled devices let you enforce screen locks, updates and the ability to wipe a lost phone. For personal phones, set clear rules about which apps and data are allowed.
Train in short, realistic bursts
A few minutes at a toolbox talk, using real examples that match your work, beats an annual slideshow. Show a sample fake delivery text and ask the crew what looks wrong.
Protect payroll and finance workflows
Require verification for changes to direct deposit or vendor banking details. A text or email alone should never be enough.
If someone clicked
- Tell IT or your supervisor immediately, even if you are not sure.
- Change passwords for any account you entered credentials into, from a different device.
- Review sign-in activity and revoke unknown sessions.
- If you shared a code or approved a prompt, assume the account is compromised and treat it that way.
- Watch for follow-up attacks that use the information captured.
A hypothetical example
Consider a hypothetical site superintendent who receives a text that appears to be from the company's HR system about a payroll issue. He taps the link and enters his login. Within the hour, the attacker has used the account to send emails to project partners. Because he reported it quickly, IT locked the account and warned the team within minutes, limiting the damage.
Support for your field teams
Ironfield Cyber builds practical mobile security and awareness programs for contractors and energy companies, from device management to short crew-friendly training. If your field staff rely on personal phones for work, we can help you set sensible rules before a text message tests them.