What Is Smishing? SMS Phishing Scams, Explained

Smishing is the text-message version of phishing — the same trick (pretend to be someone trustworthy, create urgency, get you to click or reply) delivered over SMS instead of email. The name is a portmanteau of "SMS" and "phishing," and the government agencies that track it treat it as one of the fastest-growing scam categories precisely because a text feels more immediate and more personal than an email, which makes people let their guard down faster. The same approach also works over other messaging apps, not only traditional SMS, but "smishing" remains the umbrella term agencies use regardless of which messaging channel actually carried the text.

What Is Smishing?

The Cybersecurity and Infrastructure Security Agency (CISA) defines smishing directly: "Smishing is a form of social engineering that exploits SMS, or text, messages." Per CISA's guidance, text messages can contain links that, once clicked, may open a malicious webpage, launch an application, or automatically dial a phone number — any of which can be the actual attack, not just a lure toward one.

Smishing is one of three related social-engineering categories CISA tracks by delivery channel: phishing over email, vishing over phone calls (often amplified by caller-ID spoofing over VoIP), and smishing over text. All three rely on the same underlying tactic — impersonating a trusted source to manipulate the recipient — and differ mainly in which channel the attacker uses to reach you.

How Smishing Works

A typical smishing attempt follows a predictable pattern: the message impersonates a company, bank, delivery carrier or government agency, creates a reason to act quickly (a suspicious charge, a package held for a fee, a tax refund, a prize), and includes either a link or a phone number designed to extract information or install malware once you engage with it. The Federal Trade Commission's own consumer guidance lists the most common lures: fake package-delivery alerts, warnings about suspicious account activity or an unpaid invoice, offers for free gift cards or low-interest credit cards, and bogus student-loan help.

The FTC is explicit about the tell: "Legitimate companies won't ask for information about your account by text." Any text asking you to confirm a password, card number, Social Security number or one-time verification code through a reply or a link is the scam itself, not a legitimate security check.

Smishing vs. Phishing vs. Vishing

Common Smishing Lures

• Fake package deliveries. A text claiming a parcel is held, delayed or needs a redelivery fee, with a link to "reschedule" or "pay" — frequently timed around genuine shopping seasons when real delivery texts are also common.
• Bank or account alerts. A message warning of suspicious activity, a locked account or a failed payment, pushing you to "verify" by tapping a link that leads to a fake login page.
• Prize, refund or benefit notices. Claims of a government refund, a lottery win or a free gift card, designed to get a reply with personal information to "claim" it.
• Fake invoices or subscription charges. A message about an unauthorized charge for a subscription or purchase you supposedly made, with a link or number to "dispute" it.
• Impersonated tech support. A text claiming to be from a company like Microsoft or Apple about a security issue, directing you to call a fake support number or install remote-access software. Legitimate tech support from major companies does not reach out unprompted by text to ask for a password or a remote-access code.
• Fake job offers. An unsolicited text offering a remote job, often with unusually high pay for minimal work, that eventually asks for personal information or an upfront "processing" payment to proceed.

How to Spot a Smishing Text

Per FTC and CISA guidance, a few consistent warning signs apply across almost every smishing attempt:

• It asks you to click a link or call a number to resolve account activity, a payment problem or a delivery issue you weren't expecting.
• It creates urgency — a short deadline, a threat of an account being locked, a fee that grows if you wait.
• It asks for personal or financial details directly: a password, card number, Social Security number or one-time passcode.
• The sender number looks unusual — a long number, an email-style address, or a number that doesn't match the company's real contact channels.
• It arrives for an account, order or benefit you don't actually have.
• The message contains spelling or grammar that a real company's automated notifications wouldn't typically include, or an oddly generic greeting instead of your actual name.

None of these signs is proof on its own — real companies occasionally do send texts with links, and typos happen — but any message combining urgency with a request for information or a click is worth treating as suspicious by default rather than assuming it's legitimate until proven otherwise.

What to Do If You Get a Smishing Text

1. Don't click any link or call any number in the message. The FTC's guidance is direct: legitimate companies won't ask for account information by text.
2. Verify independently. If the message might be real, contact the company or bank using a phone number or website you already know is genuine — never the contact details provided in the text itself.
3. Report it. The FTC recommends forwarding the message to 7726 (SPAM), which helps your wireless carrier identify and block similar messages, and also reporting it directly at ReportFraud.ftc.gov. Most phone messaging apps also have a built-in option to report a message as junk or spam.
4. Block the sender using your phone's built-in blocking tools, or ask your wireless provider about additional call- and text-blocking options.
5. If you already clicked or replied with information, change the affected account's password immediately, enable multi-factor authentication if it isn't already on, and watch the account for unauthorized activity. Where a service supports it, switching to a passkey instead of a password removes the one credential a smishing text is usually trying to steal in the first place.

A smishing link's malicious payload sometimes arrives as a downloaded file rather than a fake login page — in which case Windows' own built-in warning, Mark of the Web, is one of the last automatic checks standing between a tapped link and an actual infection, flagging files that originated from the internet before you open them.

What If I Already Responded?

If you've clicked a smishing link, entered credentials on a fake page, or replied with personal information, act as though that account is compromised rather than waiting to see what happens. Change the password for the impersonated account — and any other account reusing that same password, since a password manager makes it far easier to confirm no other account shares the stolen one — from a device you trust, not by following any link in the original message. CISA's general social-engineering guidance also recommends enforcing multifactor authentication (MFA) on important accounts specifically because it limits what a stolen password alone can do, and checking for anything an attacker may have changed, such as a new forwarding rule, a newly connected app, or added recovery contact information.

Why Smishing Keeps Growing

Several factors make text messages a particularly effective delivery channel for this kind of scam compared to email. People tend to check texts faster and with less scrutiny than email, since SMS has historically been a channel reserved for people you know, appointment reminders and two-factor codes rather than marketing or scams — a trust gap that attackers deliberately exploit. Phone screens also compress a sender's number and a link's actual destination into a small space, making it harder to spot a spoofed sender or a lookalike domain at a glance than it would be on a full email client. And unlike email, which has decades of spam-filtering infrastructure behind it, carrier-level filtering for SMS has historically been less mature, though the FTC's 7726 reporting short code exists specifically to help close that gap by feeding carriers real-time reports of what's getting through.

The lures themselves also track whatever is genuinely happening at the time — a tax season "refund" text, a holiday-season "delivery problem" text, or a bank-fraud alert timed to coincide with real data breach headlines — because a scam that matches something the recipient is already expecting is far less likely to trigger suspicion than a generic one.

Smishing Targeting Employees and Businesses

Smishing isn't only a consumer problem. A growing share of attacks target employees directly, impersonating a company's own IT department, HR system or a trusted vendor to get a work password, a one-time MFA code, or a click on a link that installs malware on a corporate device. Because a work phone often sits alongside personal messaging apps with no separate spam filter for work-related texts, a convincing smishing message asking an employee to "verify" a password reset or approve a pending access request can be just as effective — sometimes more so — than the same attempt made over email, where corporate spam filtering is typically much more mature. Security teams increasingly treat smishing awareness as part of standard phishing training rather than a separate, lesser risk.

What's Next

Smishing succeeds by borrowing the urgency and personal feel of a text message, not by being technically sophisticated — the underlying tactic is the same social engineering CISA describes for phishing and vishing, just delivered to the device most people check first. The FTC's and CISA's shared advice holds regardless of which channel a scam arrives through: don't act on the message's own instructions, verify through a channel you already trust, and report what you find so carriers and regulators can act on the pattern, not just your individual message.

Reporting matters more than it might seem in the moment: every message forwarded to 7726 gives carriers another data point to train the spam filters that block similar texts before they reach the next person, which is the closest thing SMS has to the collaborative spam-reporting systems email providers have run for years.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage