Cybersecurity glossary
What is Smishing?
Learn what smishing is, how SMS and messaging-app lures steal credentials and one-time codes, why mobile screens hide malicious URLs, and how to reduce SMS-based phishing risk.
Definition
Smishing is phishing delivered through SMS or other mobile text channels, using a short, urgent message and a link, callback number, or attachment prompt to trick the recipient into revealing credentials, one-time codes, payment details, or device access.
Why the text inbox is a privileged phishing channel
Smishing works because SMS already occupies a trusted slot in daily life. Parcel tracking, bank fraud alerts, appointment reminders, and one-time passwords all arrive as short messages. Attackers copy that format with almost no room for the visual clues people were trained to use in email: no full header, no hover preview, and a URL that may be truncated to https://tracking-….
The phone is also where many accounts still receive recovery codes. A successful smish can therefore skip mailbox access entirely and still intercept the second factor, complete a password reset, or harvest card details on a mobile-optimized fake site.
Sender identity on SMS is weaker than people assume. Alphanumeric sender IDs, number spoofing, and rented local numbers make “it came from my bank’s name” an unreliable signal.
How a smishing incident usually plays out
Acquire reachable numbers
Buy lists, scrape forms, recycle leaked customer files, or enumerate ranges in a target country.
Pick a mobile-native pretext
Failed delivery, unpaid toll, frozen card, missed voicemail, or an unexpected MFA code are all familiar on a lock screen.
Compress the lure
Fit urgency into one or two sentences plus a short link, QR, or callback number that fits a notification preview.
Catch the thumb tap
The victim opens a mobile page, calls a fake help desk, or replies with a code they think they are confirming.
Collect secrets quickly
Harvest passwords, OTPs, card data, or app-install permissions before the person switches back to a real app.
Abuse the account
Reset credentials, approve a payment, or hand the session to a cash-out crew while the phone is still unlocked in someone’s hand.
Templates that dominate smishing
Delivery and postage
A package cannot be delivered unless you ‘update the address’ or pay a small customs fee on a cloned carrier page.
Bank and tax urgency
A message claims unusual activity and sends you to a sign-in that also asks for the SMS code sitting in the same inbox.
IT and MFA abuse
A fake ‘you did not just log in?’ text trains the victim to share or approve a code for an attacker’s session.
Callback smishing
The text has no link. It asks you to call a number that then becomes a live vishing engagement.
Smishing versus neighboring phone threats
| Threat | Where it appears | What the user is pushed to do |
|---|---|---|
| Smishing | SMS, RCS, iMessage, some chat apps | Tap a link, reply with a code, or call a number |
| Vishing | Voice call | Speak secrets or grant remote access live |
| SIM swapping | Carrier account process | Victim may only notice lost service |
| Email phishing | Mailbox | Open a lookalike site or file, often on desktop |
The overlap is deliberate. A smish can hand the victim to a caller. A SIM swap can make the attacker the one who receives the next “real” bank SMS. Defenders should not treat these as separate user problems.
Reducing smishing success for people and for services
- Never authenticate through a link that arrived in a text. Use the official app or a bookmark already on the device.
- Move MFA and high-risk alerts off SMS toward passkeys, FIDO2, or authenticator apps that are not delivered in the same inbox as the lure.
- Tell customers, in product copy, which events you will never announce by unsolicited SMS with a link.
- On work phones, make smishing reportable the same way email phishing is reportable, including screenshots of sender IDs.
- Watch for brand impersonation in sender IDs and for bursts of similar lures hitting employee numbers after a data leak.
- Treat unexpected MFA texts as an incident signal: someone may already be trying the password. Do not ‘confirm’ the code back.
- Keep OS and messaging apps updated; some client-side protections and spam classifiers improve over time but are not complete.
- For high-risk staff, prefer numbers that are not published, and avoid using personal mobiles as the only recovery path for admin accounts.
Design choice: stop putting secrets in SMS
If your service still ships login codes and fraud alerts through the same channel criminals can spoof, you are composing the attacker’s template. Channel separation—codes in an authenticator, notifications in-app—removes the “reply with the number we just sent you” trick that smishing depends on.
The practical takeaway
Smishing is phishing edited for a lock screen. It hides URLs, borrows parcel and bank language, and sits next to the one-time codes many accounts still trust.
Tap nothing in an unexpected text to “verify.” Open the real app. For builders, retiring SMS as an authenticator is the control that survives the next template change. For users, the safest assumption is that a brand-looking message with a link is hostile until proven otherwise on a channel you initiated.
Related security terms
Phishing
The parent technique; smishing is the same deception moved onto the phone’s message inbox.
Vishing
Voice phishing that often starts after a smish asks the victim to call a number.
Quishing
QR-code phishing that similarly hides the destination from a hurried glance.
SIM Swapping
A related phone-number attack; smishing steals codes from the user, while SIM swap steals the number itself.
Social Engineering
Smishing relies on mobile habits: people read texts quickly and treat delivery and bank alerts as routine.
Frequently asked questions
What is smishing in simple terms?
Smishing is a scam text. It pretends to be a parcel update, bank warning, or one-time code so you tap a link or share information you would not type on a suspicious laptop email.
Why is SMS so effective for phishing?
Messages are short, previews hide full URLs, people keep SMS for two-factor codes, and sender names can be spoofed or rented. Many users also treat texts as more personal than email.
Is a text with my bank’s name automatically fake?
Not always, but you should not tap the link to find out. Open the bank app or a bookmark you already trust. Real institutions do not need you to authenticate through an unexpected SMS URL.
Can smishing steal MFA codes?
Yes. Some texts claim a login you did not start and ask you to ‘confirm’ by repeating a code, or they send you to a page that requests the SMS OTP in real time.
Does RCS or iMessage make smishing go away?
Richer profiles can display logos and names that increase trust. Encryption of the transport does not prove the sender is the brand. Treat branded bubbles with the same caution as SMS.
What should organizations do about smishing?
Stop using SMS as the primary MFA and alert channel where possible, tell customers which messages you will never send, monitor brand-abusing numbers, and train staff that work phones are in scope for phishing reporting.
Is a missed-delivery text always smishing?
It is one of the most copied templates. If you are not expecting a package, ignore it. If you are, check the carrier’s app or the retailer’s order page—not the link in the text.
References
Explore authoritative guidance and frameworks related to smishing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.