What is smishing?
Smishing is phishing sent by text message. The name combines SMS and phishing, and the term also covers the same lures sent through MMS, RCS, iMessage and other messaging apps. The psychology matches email phishing: authority, urgency and fear push the recipient to act before thinking. The channel is what changes, and it gives the attacker an advantage. A link opened from a text goes straight to the phone's browser, outside the company's mail gateway, web proxy and endpoint protection, and the small screen hides most of the address.
Common smishing lures
Text messages are short, so the lures are blunt and follow the calendar and the news:
- A package on hold because of an incomplete address
- An unpaid road toll or parking fine with a late fee
- A suspicious charge on a bank card, with a link to dispute it
- A tax refund or government benefit waiting to be claimed
- A message from the CEO's new number asking for a quick favor, which turns into a gift card request
- A security alert asking the user to reply with the verification code that just arrived
The last one is the most dangerous for an organization. A genuine one-time code the user did not request means someone else has started a sign-in or account reset. A follow-up text asking for that code is the attacker trying to finish the job.
How to spot a smishing text
- The sender is an unknown number, a number with an unexpected country code or an email address.
- The link domain has nothing to do with the brand, uses an unusual top-level domain or hides behind a URL shortener.
- The message asks for a payment, a card number, a sign-in or a code.
- The text asks you to reply first, which in some messaging apps enables links from unknown senders.
How to defend against smishing
Train users that no legitimate service asks for a code it just sent, and that the safe response to an alarming text is to open the official app or type the organization's known web address instead of tapping the link. Mobile device management can enforce a mobile threat defense app or DNS filtering on company phones. Phishing-resistant MFA, such as passkeys or FIDO2 keys, removes the code that smishing tries to steal. Users should report smishing aimed at work accounts through the company's reporting process. In the US and the UK, mobile carriers also accept spam texts forwarded to 7726, which spells SPAM on a keypad.
Smishing vs. vishing vs. quishing
These three are phishing moved to other channels. Smishing uses text messages. Vishing uses voice calls or voicemail. Quishing hides the link in a QR code. A text that tells the recipient to call a number combines smishing with vishing; name whichever channel the question asks about. SIM swapping is a different attack: the attacker moves the victim's phone number to a new SIM so the codes go to the attacker's device, rather than tricking the victim into sending them.
Smishing on the CompTIA Security+ exam
Smishing sits under SY0-801 objective 2.5 with the other social engineering attacks. The deciding clue is the channel: a text message, iMessage or RCS message with a link or a request for a code or payment. Distractors include phishing (email), vishing (a phone call), quishing (a QR code) and SIM swapping. For defense questions, look for user training, reporting, mobile device management and phishing-resistant MFA. The term also appears in A+ Core 2 (220-1202) objective 2.5.