At 6:15 on a Friday evening, a text arrives on an employee's personal phone: an unpaid road toll of $4.35, a $50 late fee if it isn't paid by midnight, and a link. Two minutes later her card number, expiry date and security code are on a criminal's screen. Nothing ever touched her work inbox or its filters.
Phishing doesn't need email. On the CompTIA Security+ SY0-801 exam, smishing, vishing and quishing sit beside phishing under objective 2.5 as social engineering attacks you'll need to recognize from a scenario's details. Quishing is the newest of the three names. This lesson covers how each attack reaches its victim, the indicators that give it away, and the verification habits that defeat all three.
Every channel a person trusts can carry the same lure
Smishing is phishing by text message, vishing is phishing by voice call, and quishing is phishing through a QR code. The psychology is the same as in email phishing: authority, urgency, intimidation and the other principles covered in the previous lesson. What changes is the channel, and each channel gives the attacker something email doesn't.
Personal phones sit outside most corporate defenses. A link in a text or a scanned QR code opens in the phone's browser, which doesn't pass through the company's mail gateway, web proxy or endpoint protection. Small screens hide full web addresses, and people treat their phones as personal and trust them more than an inbox they know is full of spam. A live phone call adds what no message can: an attacker who answers objections and adjusts the story the moment the victim hesitates.
The wider set of message-based and image-based vectors, including RCS, instant messaging and collaboration tools, is covered in the threat vectors section.
Smishing hides a short link inside a believable text
Smishing lures are short, because a text has to make its point in a sentence or two. The common ones follow the news and the calendar: a package that couldn't be delivered, an unpaid toll, a suspicious charge on a bank card, a tax refund, a job that pays well for little work. Inside companies, a frequent version appears to come from the CEO: "New number, saving it now. Are you free? Need a quick favor." The favor turns out to be buying gift cards and texting back the codes.
A typical example:
Delivery notice: Your parcel is on hold due to an incomplete address. Update within 24 hours to avoid return to sender: parcel-redelivery-center.top/track
Indicators to look for:
- The sender is an unfamiliar number, a number with a foreign country code, or an email address, since many smishing texts are sent from email accounts through iMessage or email-to-SMS gateways.
- The link's domain has nothing to do with the brand, often sits on a cheap top-level domain such as .top or .xyz, or is hidden behind a URL shortener.
- The message asks for a small payment, card details, a sign-in or a code.
- The text asks you to reply before the link will work. Some messaging apps disable links from unknown senders until the recipient replies, so "Reply Y to activate this link" is an attempt to switch that protection off.
The most valuable smishing text for an attacker is the one that steals an MFA code. A user receives a genuine verification code from a real service, then seconds later a text "from security" asks them to reply with it to avoid a lockout. The first code only arrived because someone who already has the password is signing in. No legitimate service asks you to send back a code it just sent you.
Users should report smishing that targets work accounts through the company's reporting process. In the United States, most carriers also accept spam texts forwarded to 7726, which spells SPAM on a keypad.