Smishing: My Son Received a Fake Rabobank Text — And He’s Not Even a Customer

My 16-year-old son received a text message last week. It appeared to come from Rabobank. There was only one problem: he has never had a Rabobank account.

This is called smishing — phishing via SMS. It is one of the fastest growing cyber threats targeting businesses and families across the Netherlands.

When your father runs a cybersecurity company

My son is 16. Always with his iPhone in his hands — WhatsApp, Snapchat, Instagram and what not. He did not press the link. He called me instead.

My first question was: "Did you press the link?" He hadn't. But that one phone call prompted a series of questions — and this series of articles.

He had already experienced an account takeover on Instagram. We had already had the talk. But does a teenager really pay attention to malicious links with the constant FOMO and hundreds of messages arriving every day?

What could have happened

My son didn't click the link. But what if he had? The link would have led to a fake Rabobank page designed to look identical to the real one. The consequences could have been serious — even without a bank account.

Criminals don't always need banking details. A name, a phone number, an email address and a date of birth is enough to start building a profile. That profile gets sold, reused and combined with data from other breaches. The damage can show up months or years later.

Clicking a link — even without entering anything — can install malware, confirm your number is active, or trigger a follow-up vishing call. One wrong tap opens the door to the next attack.

How criminals approach teenagers

Cybercriminals know exactly how teenagers think and behave online — and they exploit it deliberately.

First, they use platforms teenagers trust. Fake notifications mimicking Instagram, Snapchat or WhatsApp warn that an account has been suspended or accessed from an unknown device. The branding looks real, the urgency feels genuine.

Furthermore, FOMO is a powerful weapon. A message saying "your account will be deleted in 24 hours" triggers panic — and panic kills critical thinking. That split second of anxiety is exactly what criminals count on.

Finally, criminals go where teenagers already are. Not just SMS — WhatsApp, Discord, TikTok, Roblox. Anywhere there is volume, speed and distraction. As a result, a teenager receiving hundreds of messages a day, conditioned to tap and scroll quickly, is exactly the kind of distracted victim a criminal needs.

The numbers will astound you

Why does it work?

Most smishing attacks don't rely on sophisticated targeting. Instead, criminals send millions of messages without knowing your name, your bank, or whether you're a customer. Scale, trust, and a moment of distraction are often all they need.

For example, a fake delivery notification arrives while you're expecting a package. A bank alert appears while you're busy at work. A security warning pops up late at night. In each case, urgency overrides caution for a brief moment. As a result, only a handful of victims out of thousands of messages is enough to make these campaigns profitable.

However, sometimes the attackers know more than you think. Data breaches, social media profiles and leaked personal information can make fraudulent messages look surprisingly convincing.

What can we do?

Lecturing teenagers rarely works. What I advocate is storytelling — using real, relatable examples that connect to their world — combined with clear do's and don'ts they can actually remember and act on.

My son didn't click the link partly because we had already talked about his own Instagram account takeover. That experience made it real. When something happens to you or someone they know, share it. A real story beats a warning every time.

Keep the conversation going. One talk is never enough. Cybercriminals evolve constantly — and so should your conversations at home.