What Is Smishing? SMS Phishing Explained
Smishing is phishing delivered through SMS text messages. Learn how smishing attacks work and why mobile screens make them harder to detect.
How Smishing Works
Smishing messages impersonate trusted organizations: banks alerting customers to suspicious activity; delivery services notifying of package issues; government agencies demanding urgent action; employers sending urgent communications; and two-factor authentication messages requesting code verification. The messages include links to phishing pages that steal credentials or install malware, or phone numbers connecting to fraudulent call centers that extract information through social engineering.
Package delivery smishing is among the most effective because it aligns with a realistic expectation — most people are expecting deliveries at any given time. A text claiming a package requires address confirmation, from a familiar shipping carrier brand, with a link to a convincing carrier login page, captures credentials from a meaningful percentage of recipients who happen to be expecting a delivery.
Corporate Smishing Risks
Enterprise smishing attacks target employees with messages impersonating IT support, HR, and executive leadership. A text appearing to be from IT requesting MFA code confirmation, or an HR notification about urgent payroll issues, creates urgency that bypasses normal skepticism. Corporate smishing is particularly effective because employees' personal phones typically lack the mobile device management and security controls that protect corporate endpoints.
Defending Against Smishing
Technical defenses against smishing are less mature than email security controls. Mobile network operators offer spam filtering that catches known malicious numbers. Mobile security products for managed devices provide link reputation checking. The primary defense remains user awareness: understanding that legitimate organizations do not request credentials or codes through text links; using verified app or website access rather than links in unexpected messages; and reporting suspicious messages rather than engaging with them.
Related Reading
Frequently Asked Questions
What is the difference between smishing and phishing?
Phishing is delivered through email; smishing is delivered through SMS text messages. The psychological techniques are the same — impersonating trusted brands, creating urgency, requesting credentials or actions — but the delivery channel changes the dynamics. SMS has 98% open rates versus email's roughly 20%, mobile screens display less context for evaluating legitimacy, and mobile devices typically have weaker security tooling than enterprise email environments. The result: smishing converts at higher rates than equivalent email phishing.
Why are smishing attacks more effective than email phishing?
SMS has historically been a high-trust channel because it was harder to spoof than email and was used primarily for one-time codes and direct communication. Users do not apply the same skepticism to text messages as to email. Mobile screens crop URLs and hide the underlying domain, making lookalike URLs harder to detect. Mobile devices typically lack the email gateway protection, link rewriting, and attachment sandboxing that enterprise email environments provide. The combination of trust, limited context, and weaker tooling makes smishing structurally easier to execute successfully.
What are the most common smishing scenarios?
Package delivery alerts impersonate shipping carriers requesting address confirmation or payment of small fees — effective because most people are expecting deliveries. Bank fraud alerts impersonate financial institutions warning of suspicious activity and directing victims to fake login pages. Tax and government scams impersonate IRS, DMV, or other agencies demanding urgent action. Corporate impersonation targets employees with messages claiming to be from IT, HR, or executives. Two-factor authentication interception sends fake 2FA codes hoping recipients will respond with the legitimate code they just received.
Can mobile devices be protected against smishing?
Partial protection exists. Mobile network operators offer spam filtering that catches known malicious numbers and patterns. iOS and Android both include link reputation checking in Safari and Chrome that warns of known phishing sites. Mobile threat defense products (Lookout, Zimperium, Wandera) provide enterprise-grade smishing detection for managed devices. None of these provide the comprehensive protection that mature email security stacks deliver for email — the smishing defense gap remains larger than the email phishing defense gap.
What is vishing and how does it relate to smishing?
Vishing is voice phishing — phishing delivered through phone calls. Vishing and smishing are often combined: a smishing text directs the recipient to call a phone number, where a vishing agent extracts credentials or financial information. The combined approach is more effective than either alone because the recipient initiates the call, creating a sense of agency that reduces skepticism, and the live conversation provides social engineering opportunities that automated text exchanges cannot.
How do attackers get our phone numbers?
Data breaches that have leaked phone numbers number in the billions of records. Phone numbers are routinely included in employee directories, LinkedIn profiles, conference attendee lists, and corporate websites. Data brokers compile and sell phone number lists matched to organizational affiliations. Sophisticated smishing campaigns target employees of specific organizations using phone numbers harvested from these sources. The assumption should be that employee phone numbers are publicly available, not protected information.
What should an employee do if they receive a suspicious text?
Do not click any links. Do not call the number provided. If the message claims to come from a known organization (bank, employer, delivery service), open the official app or visit the verified website directly to check for the alleged issue. Report suspicious texts to the organization's security team and forward them to 7726 (SPAM) for the carrier to investigate. Block the sender. Never reply, even to messages claiming "reply STOP to unsubscribe" — any reply confirms the number is active and increases targeting.
Real-World Example: Twilio Smishing Attack 2022
In August 2022, Twilio suffered a breach after attackers sent smishing messages to employees impersonating IT, claiming their passwords had expired and directing them to a convincing Twilio SSO phishing page. Multiple employees clicked the link and provided credentials, giving attackers access to Twilio's internal tools. The attackers used that access to reach customer accounts, ultimately affecting Signal, Okta, and other Twilio customers. The attack demonstrated that even sophisticated technology company employees are vulnerable to well-crafted smishing attacks targeting their personal phones.
SMS open rate — compared to 20% for email. Smishing attacks exploit the behavioral norm of reading every text message, combined with limited mobile screen context that makes phishing links harder to evaluate.