Smishing (SMS phishing) is a social engineering attack delivered through text messages that trick recipients into clicking malicious links, downloading malware, or providing sensitive information. The attacker sends SMS messages impersonating banks, delivery services, government agencies, or employers. Smishing exploits the higher trust and open rates associated with text messages compared to email.
The attacker sends bulk SMS messages using commercial messaging services, SIM farms, or compromised phone number pools. Messages typically contain urgent alerts such as package delivery failures, suspicious account activity, or prize notifications, along with a shortened URL. The link directs victims to a convincing phishing page that mimics a legitimate service login, payment portal, or form. Some smishing attacks deliver malware payloads that, once installed, can intercept SMS messages, steal contacts, and access banking applications. More targeted attacks reference the victim by name, include partial account numbers from leaked data, or impersonate their employer's IT department requesting credential verification. The attackers harvest credentials, session tokens, or payment details submitted through these fraudulent pages.
Smishing has become one of the fastest growing attack vectors because mobile users are less cautious with text messages than email. SMS lacks the spam filtering sophistication of email platforms, and shortened URLs obscure the true destination. Financial institutions, cryptocurrency platforms, and e-commerce services are the most commonly impersonated. Organizations should educate users to never click unsolicited links in text messages, implement mobile device management policies, deploy mobile threat defense solutions, and use app-based authentication instead of SMS for sensitive operations.