What is smishing?
Definition
Smishing is phishing by text message: a scammer sends an SMS pretending to be a bank, delivery company or agency and tries to get you to click a link or share personal details.
- Category
- Scams
- Also called
- SMS phishing, text message phishing
- Last updated
The word is a mix of "SMS" and "phishing". A smishing text looks like a normal message from a company you know and pushes you to act fast. The FTC says scammers try to get you to click links by promising you something, or by sending fake alerts about your account or a transaction.
Common versions
- Bank fraud alerts. The FTC reports that the most-reported text scam looks like a fraud alert from your bank. It isn't.
- Package and delivery notices asking you to pay a small fee or confirm an address.
- Impersonation of well-known names. The FTC has noted spikes in reports of texts that appear to come from big retailers and the postal service.
- Fake refunds and loans. Recent FTC alerts describe fake Amazon refund texts and a fake follow-up about a $10,000 loan application.
- Login traps. One FTC alert covered a fake party invitation that asked people to enter their email address and password to see the event details.
What happens if you tap
The link opens a fake website built to copy a real one, where you are asked for a password, card number or one-time code. Or it asks you to call a number or reply, which starts a vishing-style conversation. Either way, the attacker gets what they need to take over an account or take your money.
Why they know your name
Some smishing texts are generic and some use your name or the company you really use. That information can come from breaches, public records and people-search listings.
Smishing vs. related terms
- Phishing is the general attack, usually by email.
- Vishing is the same attack by phone call.
- Spear phishing is a targeted version written for one person.
- Spoofing is faking the sender, which smishing messages often do.
How to protect yourself
- 1
Don't click links in unexpected texts
The FTC's advice is not to click links or reply. If a message might be real, contact the company using a phone number or website you know is genuine.
- 2
Report and delete
Forward the text to 7726 (SPAM), use your phone's junk-report option and report it at ReportFraud.ftc.gov, then delete it.
- 3
Never share one-time codes
A code sent to your phone is for you only. No bank or company needs you to read it back.
- 4
Use two-step verification
If a password is captured, a second step can still stop the login.
- 5
Reduce what scammers can find about you
Texts that use your real details are more convincing. Serus finds where your address and phone number are listed and removes them, which cuts down the details a scammer can use to make a message sound personal.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between smishing and phishing?
Phishing is the general term, usually email. Smishing is the same trick by text message.
What should I do if I clicked a smishing link?
Don't enter anything on the page. If you did, change that password right away, turn on two-step verification and contact your bank if you shared card details. Report the text at ReportFraud.ftc.gov.
How do I report a scam text?
Forward it to 7726 (SPAM), use your phone's junk-report option and report it to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.