What Is Smishing and How Do You Protect Yourself?

Smishing (also called SMS phishing) is a cyberattack in which criminals send fraudulent text messages that pretend to come from a trusted company or person. The goal is to trick you into clicking a malicious link, sharing personal information, or sending money.

Smishing works like email phishing, but it targets the device most of us carry everywhere: our phones. As ways to receive texts expand, so do the scams. Smishing occurs through iMessage, WhatsApp, and other messaging apps.

Why Smishing Attacks Work

We trust our phones. They’re where we check the weather, answer email on the go, and get alerts from our bank. That familiarity makes us less suspicious of what shows up there, so we tend to react quickly instead of stopping to think.

Text messages also make it hard to spot a fake. There’s no sender address to inspect, links are often shortened, and a small screen hides details you might notice on a computer.

For attackers, smishing is cheap and easy:

• Sending texts costs almost nothing. Free texting apps and email-to-text gateways let anyone send messages without verifying their identity.
• Phone numbers are easy to fake. Attackers can spoof numbers, so a text appears to come from a real company.
• Phones hold the keys to other accounts. Many services send login codes by text, so a phone number is a valuable target on its own.

How Scammers Get Your Phone Number

You’ve probably shared your mobile number in more places than you realize. Common sources include:

• Data breaches. When a company you do business with is breached, phone numbers are often part of the stolen data and end up for sale online. Dark web monitoring can alert you when your information appears there.
• Rewards programs and checkout counters. Many stores use your phone number as your account ID, and anyone nearby can hear you say it.
• Business cards, email signatures, and websites. Professionals often publish their mobile numbers, which makes employees easy to target.
• Everyday forms. Restaurants, doctors’ offices, salons, and online sign-ups all collect phone numbers.
• Random guessing. Automated tools simply text huge blocks of numbers and wait for someone to reply.

Common Smishing Examples

Smishing messages change with the news and the seasons, but most follow a few familiar patterns. Here are six you’re likely to see.

Unpaid toll notices

“Final notice: You have an outstanding toll balance of $6.99. Pay now to avoid a $50 late fee: tolls-pay-now.example”

Toll scams have become one of the most widespread smishing campaigns, and the FBI has warned the public about them. The small amount makes paying feel harmless, but the real goal is your card number.

Package delivery problems

“USPS: Your package is on hold due to an incomplete address. Update your details within 24 hours: delivery-update.example”

These texts work because most of us expect a package at any given time.

Bank fraud alerts

“Bank Alert: A $1,240 purchase was flagged on your account. If this wasn’t you, reply NO or call 555-0100.”

Replying or calling connects you to a scammer posing as your bank’s fraud team, who will ask you to “verify” your account details.

The boss who needs a favor

“Hi, it’s [CEO’s name]. I’m in a meeting and need you to grab some gift cards for a client. Can you handle this quickly? I’ll reimburse you.”

This is a business email compromise moved to text. Attackers research company leaders online and target employees who want to be helpful.

Verification code requests

“Hi, I accidentally sent my verification code to your number. Can you text it back to me?”

That code is usually for your account. Sharing it lets the attacker log in as you or take over your messaging app.

“Wrong number” conversations

“Hi Sarah, are we still on for dinner Thursday?”

If you reply that they have the wrong number, the scammer keeps chatting in a friendly way. Over days or weeks, the conversation turns into a pitch for a fake investment or cryptocurrency opportunity.

Warning Signs of a Smishing Text

Most smishing messages share at least one of these red flags:

• Urgency or fear. Threats of account closure, late fees, legal trouble, or harm to someone you love are designed to make you act before you think.
• A message you didn’t expect. An alert about a package you didn’t order or an account you don’t have is a strong sign of a scam.
• A link or a request to reply. Legitimate companies rarely ask you to fix a problem through a text link.
• Requests for codes, passwords, or payment. No real bank, employer, or government agency will ask for these by text.
• Unusual payment methods. Gift cards, wire transfers, cryptocurrency, and payment apps are favorites because the money is hard to recover.
• Odd sender details. An email address in place of a phone number, a long or unfamiliar number, or a misspelled company name.
• Shortened or strange links. Watch for web addresses that almost match a real company but add extra words, dashes, or unusual endings.

Don’t rely on spelling mistakes to spot a fake. AI tools now help scammers write polished messages that sound exactly like a real company.

How To Protect Yourself from Smishing

The best defense is to slow down and never interact with a suspicious message. These habits will stop most smishing attempts:

• Pause before you act. Urgency is the scammer’s main tool. Taking even a minute to think breaks the spell.
• Don’t click links in unexpected texts. Instead, open the company’s app or type its web address yourself.
• Verify through a channel you trust. Call the number on the back of your card or on the company’s official website, not the one in the text.
• Don’t reply, not even “STOP.” Any reply to a scam text confirms your number is active and can lead to more messages. Only use STOP for companies you know you signed up with.
• Never share verification codes. A code sent to your phone is for you alone, no matter who asks for it.
• Use stronger sign-in methods. Text message codes can be stolen through SIM swapping, where an attacker convinces your carrier to move your number to their phone. Use an authenticator app or passkeys when a service offers them, and ask your carrier about adding a PIN or port-out lock to your account.
• Turn on spam filtering. iPhone users can filter unknown senders in Messages settings, and most Android phones include built-in spam protection.
• Keep your phone updated. Updates fix security flaws that malicious links can exploit.

How To Report a Smishing Text

Reporting helps carriers and investigators block scammers for everyone. In the US:

1. Forward the message to 7726 (it spells SPAM). Your carrier will use it to block the sender.
2. Use the Report Junk option in your messaging app.
3. Report the scam to the FTC at ReportFraud.ftc.gov.
4. If the message relates to your job, take a screenshot and send it to your IT team.
5. Then delete the message so you don’t tap it by accident later.

What To Do if You Clicked a Smishing Link

If you clicked a link or replied, act quickly. Fast action can stop a small mistake from becoming a serious problem.

1. Stop interacting. Close the page and don’t enter any more information.
2. Change your passwords for any account you logged in to or that the message referenced. Do it from a different device if possible.
3. Turn on multi-factor authentication for those accounts if it isn’t already on.
4. Call your bank using the number on your card if you shared payment details, and ask them to watch for fraud.
5. Tell your IT team right away if it involved a work phone or work account. Nobody should be afraid to report a mistake.
6. Watch your accounts for unfamiliar logins, purchases, or password reset emails over the next few weeks.

For businesses, a fast and organized breach response can contain the damage before it spreads.

How Businesses Can Protect Employees From Smishing

Smishing is a business risk, not just a personal one. Employees use their phones for email, approvals, and sign-in codes, and most smishing happens outside your email filters. These steps close that gap:

• Train your team on smishing, not just email phishing. Include real examples and simulated text message tests in your security awareness training, so employees practice spotting scams before a real one arrives.
• Set a clear “we will never text you” policy. Tell employees that leaders will never request gift cards, payments, bank changes, or sign-in codes by text. When everyone knows the rule, a fake request stands out immediately.
• Manage and secure company phones. Mobile device management lets you enforce passcodes and updates, separate work and personal data, and wipe a lost or compromised device.
• Protect the devices themselves. Mobile endpoint security can block known malicious links and detect risky apps.
• Move away from SMS sign-in codes. Use authenticator apps, number matching, or passkeys for business accounts so a stolen text message can’t unlock them.
• Make reporting easy and blame-free. Give employees a simple way to report suspicious texts, and thank them when they do. People hide mistakes when they fear getting in trouble.

Smishing is one part of a bigger picture. Our phishing protection services help defend your team across email, text, and voice. For more everyday tips, see our guide on how to improve cybersecurity.

Smishing vs. Phishing vs. Vishing

These attacks are all forms of social engineering. The difference is the channel the attacker uses to reach you.

Attackers often combine them. A smishing text may tell you to call a number, turning it into a vishing call. The same defense works for all of them: slow down and verify through a channel you trust.

Stay One Step Ahead of Smishing

Smishing in cybersecurity is a growing threat because it targets the device we trust most and reaches us outside the protection of email filters. The good news is that the defense is simple: slow down, don’t click, verify through a trusted channel, and report what you see.

Share this guide with your colleagues, family, and friends. The more people who know the warning signs, the less effective these scams become.

Want your team ready for the next smishing text? Explore ACC’s Security Awareness Training and give employees the skills to spot and stop scams before they cause damage.

Editor’s note: This article was originally published on August 10, 2022, and has been updated for freshness and accuracy.