What is smishing and phishing?
Definition
Smishing is phishing sent by text message (SMS), and phishing is the wider scam where someone pretends to be a trusted company or person to trick you into giving up information or clicking a bad link.
- Category
- Scams
- Also called
- smishing vs phishing, sms phishing, text message phishing, smishing
- Last updated
The two words describe the same trick, delivered two different ways. Phishing usually means email, though it also covers phone calls (vishing) and social media messages. Smishing is phishing by text. The name comes from SMS plus phishing.
How they work
The FTC's advice is to ask whether you have an account with the sender or know the person. If not, treat the message as likely phishing. Scam messages usually claim a problem with your account, a suspicious login or a payment issue, then push you to act now. They link to a fake page that asks for passwords, card numbers or a Social Security number, or they ask you to reply with a code.
An example
A text says: "Your parcel is held. Pay a $1.99 fee here." The link opens a copy of a delivery company's site. You enter your card number, and the scammer has it. The same message sent as an email would be phishing; as a text, it is smishing.
Why smishing works
Texts feel personal and urgent, they're read within minutes, and the sender's number can be spoofed. The link is also harder to inspect on a phone screen. Scammers often have your name and number from data broker listings, which makes the message look more legitimate.
Spear phishing
Spear phishing is aimed at one person and uses details about them, such as your employer or a recent purchase. It is much harder to spot than a mass message.
How to protect yourself
- 1
Don't click or reply
The FTC says that if you don't have an account with the sender or know them, don't click links or reply.
- 2
Verify through a channel you already trust
If a message might be real, go to the company's website or call the number on your card. Don't use the contact details in the message.
- 3
Never share codes
One-time codes are the key to your account. No real company will ask you to read one out.
- 4
Report and delete
Forward scam texts to 7726 (SPAM), report them at ReportFraud.ftc.gov and delete them. If you gave information away, go to IdentityTheft.gov.
- 5
Make your details harder to find
Scammers target you with data from people-search sites. Serus finds where your phone number and address are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between smishing and phishing?
Smishing is phishing sent by SMS text message. Phishing is the wider term and most often refers to email.
What should I do if I clicked a smishing link?
Don't enter anything. If you did, change the password for that account and any account using the same one, contact your bank if you shared card details, and report it at ReportFraud.ftc.gov. If your identity may be exposed, see IdentityTheft.gov.
How do I report smishing?
Forward the text to 7726 (SPAM), use your phone's report junk option, and report it to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.