Smishing is phishing delivered by text message, using a short link or urgent wording to push a harmful action on a phone.
The channel is the phone message, not email, which changes both the clues people can see and the filters that apply.
How it works
Texts are short, so the lure leans on urgency, a familiar brand, and a link or a reply that captures a code.
Package notices, bank alerts, and prize claims are common pretexts because they fit in a small screen.
People trust texts from numbers that look local, and phones make it easy to tap before reading.
Training and carrier filtering help, and accounts should not treat a texted code as enough to move money or change mail.
Concrete examples
- A text says a parcel needs a fee and links to a page that copies a delivery brand.
- A bank style text asks the reader to reply with a one time code that just arrived.
- A prize text urges a tap before the offer expires in the next few minutes.
Protective measures
- Teach people to reach banks and carriers through apps or numbers they already saved, not through a fresh text link.
- Do not approve payments or password resets that depend only on a code sent by text.
- Report smishing to your mobile provider and to the impersonated organization using a contact from its real site.
- Filter links in text gateways you operate, and keep verification messages free of surprise demands for secrets.
Related articles
What is phishing? explains the broader impersonation attack that smishing carries over a text channel.
What is SIM swapping? explains theft of the mobile number that receives the text codes these lures request.
What is security awareness training? explains staff training that should include text lures, not only email examples.