Unexpected links, urgent language, requests for personal information you did not ask for, and messages from unknown or spoofed numbers.
What is smishing? How to spot and stop SMS phishing attacks
What smishing is, the five steps of an SMS phishing attack, the four most common lures, and what individuals and companies can do to stop it.
By 6 mins readPublished Updated On this page
‘Your bank account has been suspended. Click the link to verify your identity.’ The sender name matches your bank, the link looks official, and the message gives you just enough panic to tap before you think.
That is smishing: phishing by SMS. Security researchers have reported a steady rise in SMS scams since 2023, because phones are now where people bank, log in and shop, and a text still gets the trust that email lost.
What is smishing?
Smishing is SMS plus phishing: a fraudulent text that gets the reader to tap a malicious link, install a file or hand over personal details. People read texts faster than email, trust them more and act with less thought, which suits social engineering.
The message manufactures urgency, curiosity or fear so the reader acts before checking.
Smishing vs. phishing vs. vishing
All three are social engineering. The channel differs:
- Phishing uses email
- Vishing uses voice calls
- Smishing uses text messages
Smishing is the hardest of the three to filter. Email has spam scoring, link rewriting and warning banners; SMS has almost none, so the text lands unmarked.
How smishing works
Most attacks follow the same five steps.
- The bait. A text claims to be from a bank, a government agency, a courier or a workplace system and describes a problem that needs attention now: a failed payment, a suspended account, a held parcel.
- A spoofed sender. The sender ID is forged to show the bank's or the courier's name, so the message sits in the same thread as the real ones.
- Pressure. Respond within 10 minutes, verify now, urgent action needed. The deadline exists to stop the reader checking.
- The payload. A link to a fake site, a request for an OTP or login, a file or app posing as a legitimate tool, or a reply that reveals personal information.
- The harvest. Banking credentials, identity details, email and social media logins, multi-factor authentication (MFA) codes. Some links also install malware or spyware on the phone.
The research that precedes the message, picking the brand, the timing and the lure from public information about the target, is what MITRE ATT&CK catalogues as Reconnaissance (TA0043).
Common smishing examples
Four lures cover most of what gets sent. Each borrows a routine the reader already follows, which is why they look harmless.
Bank or card verification. A warning of suspicious activity, a blocked account or an unauthorized transaction, with a request for login details or an OTP to clear it.
Package delivery. A missed delivery or a small courier or customs fee, heaviest around festive sales and the holiday season.
Tax refunds and government notices. A refund waiting to be claimed or a penalty to be avoided, both needing details verified first.
Password reset and 2FA alerts. A fake reset notice or suspicious-login alert that sends the reader to a phishing page to re-enter credentials.
Why smishing scams work so well
Four things. A text feels personal, so people assume it came from a verified sender. SMS networks have nothing like email's spam detection, so the message arrives unfiltered. The format forces short messages, and ‘Your account is locked, tap to fix’ gets a faster reaction than a paragraph would. And banking, authentication and shopping all happen on the phone now, so one distracted tap is enough.
What smishing costs
Victims authorize fraudulent transactions, hand over card details, or give up enough identity data for someone to open accounts and file tax returns in their name.
Companies lose twice. Staff who use their own phones for work (BYOD) turn a compromised phone into a way into corporate systems, and customers lured in a company's name blame the company.
Industry reporting puts more than half of SMS scams at mobile banking users, and several high-profile 2023 and 2024 breaches were traced to smishing of employees.
How to prevent smishing
For individuals
Treat unexpected messages as suspect. If a text demands action now, that is the reason to pause.
Verify through a channel you chose. Open the bank's app, type the address yourself or call the number on your card. Never use the link in the text.
Never share codes. No legitimate company asks for an OTP, PIN or password by SMS.
Keep the phone patched. OS updates, a reputable security app and a browser that warns about known bad sites stop many malicious links before they load.
Turn on MFA. A stolen password alone then gets the attacker nothing, which is why so many lures ask for the code itself.
For organizations
Train the teams that get targeted most, finance, HR and customer-facing staff, with real examples rather than policy slides. Put mobile device management (MDM) on phones that touch company data so you can push security settings and block unsafe apps. Filter SMS where you can; tools that block known malicious patterns cut what reaches staff. And include smishing in phishing simulations, so the first fake text an employee sees is yours.
What to do if you tapped
Move fast, in this order:
- Stop responding and delete the message.
- Take the phone offline.
- Change passwords, starting with email and banking.
- Tell your bank if financial details may have been exposed.
- Report it to your regional cybercrime portal.
- Run a full device scan with reputable mobile security software.
Where to start
Smishing works because a text gets trust it has not earned. The habit that beats it: never act on a link or a code request that arrived by SMS; open the app or type the address yourself.
For a business, assume the credentials and OTPs taken from customers lured in your name will be replayed against your login. That is where account takeover protection scores the session on device, network and behavior signals and lets your rules block it. Read how OTP bots turn a stolen code into a takeover next.
FAQs