How text-message phishing works, how to recognise it and how organisations can reduce the risk

Smishing is phishing through SMS or text messages. Attackers impersonate trusted sources to induce unsafe actions such as sharing credentials, making payments or following malicious links. Similar scams also occur through other mobile messaging channels.

What does smishing mean?

The word smishing combines “SMS” and “phishing”. It refers to phishing through SMS or text messages that manipulates recipients into unsafe actions. Similar mobile-message scams can also arrive through RCS, iMessage, WhatsApp, Telegram or Signal; these belong to the wider problem of messaging-based phishing.

A smishing message normally pretends to come from a trusted source, such as a bank, delivery company, government department, employer, healthcare provider or senior executive. The objective is usually to steal money, obtain credentials or personal data, compromise a device, or create access that can be used in a wider cyberattack.

How does a smishing attack work?

Smishing relies on social engineering. The attacker creates a believable pretext, introduces urgency or emotional pressure, and directs the recipient towards a harmful action before they have time to verify the request.

  • A fake delivery message asks the recipient to pay a small redelivery fee.
  • A message appearing to come from a bank claims that an account has been locked or a payment must be verified.
  • A message impersonating a senior leader asks an employee to purchase gift cards or transfer money.
  • A fake government, tax or benefits message promises a refund or threatens a penalty.
  • A healthcare-themed message asks the recipient to confirm personal details or follow a link to an appointment portal.
  • A malicious link opens a convincing imitation of a legitimate sign-in or payment page.
  • An attachment or downloaded application installs malware or gives an attacker control of the device.

Attackers may also spoof sender names or use compromised accounts, making a message appear within an existing conversation. This is one reason spelling and grammar alone are no longer reliable indicators of fraud.

What are the main warning signs of smishing?

The National Cyber Security Centre and Ofcom advise people to be cautious when a message creates pressure, requests sensitive information or contains an unexpected link. Common warning signs include:

  • Unexpected contact from an organisation or person.
  • A request for passwords, PINs, bank details, payment-card information or other sensitive data.
  • A demand to act immediately or face a negative consequence.
  • A message that creates panic, fear, curiosity, excitement or fear of missing out.
  • A request to keep the communication secret.
  • A shortened, misspelled or unfamiliar web address.
  • A payment request that is unusual for the apparent sender.
  • A message that asks the recipient to bypass normal business procedures.
  • A sender identity, tone or request that does not match previous legitimate communications.

A professional-looking message can still be fraudulent. If there is any doubt, contact the organisation through a trusted route, such as the number on an official website, bank card or statement. Do not use contact details supplied in the suspicious message.

What is the difference between smishing, phishing and vishing?

Phishing is the broad term for deceptive communications designed to steal information, money or access. Smishing is phishing delivered through text or mobile messaging. Vishing is voice phishing conducted through telephone calls or voice messages. The same campaign may use several channels together, for example a text followed by a convincing phone call.

Why is smishing a serious organisational risk?

Smishing is not only a consumer-fraud issue. It can provide an entry point into corporate systems, payment processes and sensitive data. Employees increasingly use mobile devices for authentication, email, messaging and business applications, which makes mobile communications part of the organisation’s attack surface.

A successful attack may lead to:

  • Credential theft and account takeover.
  • Fraudulent payments or changes to supplier bank details.
  • Malware infection or unauthorised remote access.
  • Loss of personal, financial, commercial or health information.
  • Compromise of multi-factor authentication codes.
  • Business email compromise and lateral movement into wider systems.
  • Regulatory, contractual and reputational consequences.
  • Operational disruption and incident-response costs.

How should individuals respond to a suspicious text?

The safest immediate response is to stop and verify. Ofcom advises recipients not to reply, click links, press buttons or share personal or financial details. A suspicious SMS can be forwarded free of charge to 7726, which spells “SPAM” on a telephone keypad. Messages received through apps should also be reported and blocked using the platform’s built-in controls.

  • Do not click the link or open an attachment.
  • Do not reply, even to request removal, when the sender is unknown.
  • Verify the request through an independently obtained contact route.
  • Forward suspicious SMS messages to 7726.
  • Use the relevant app or device feature to report and block the sender.
  • Delete the message after reporting it.
  • Tell the organisation’s security or IT team if the message relates to work.

What should someone do after clicking a smishing link?

Action should be taken quickly. The appropriate response depends on what happened, but it may include disconnecting the device from networks, changing compromised passwords from a trusted device, notifying the bank or payment provider, contacting the mobile network, and reporting the incident to the employer or relevant authority.

If money was sent or banking details were disclosed, the individual should contact the bank immediately using a trusted number. If work credentials, confidential information or access codes were exposed, the organisation’s security team should be notified without delay so that sessions can be revoked, accounts protected and logs reviewed.

How can organisations reduce smishing risk?

1. Establish trusted communication patterns

The NCSC recommends that organisations make legitimate messages easy to distinguish from fraudulent ones. Keep sender IDs, telephone numbers and communication channels consistent. Avoid asking customers or employees for sensitive information by text, avoid links where possible, and clearly explain what the organisation will and will not request through mobile messages.

2. Build realistic awareness and reporting

Training should show employees how modern smishing works and give them a simple, blame-free reporting route. Staff should know that urgency, authority and emotional pressure are common manipulation techniques. Reporting should be fast enough to allow the security team to warn others, block malicious destinations and assess whether credentials or data were exposed.

3. Protect identities and access

Use phishing-resistant authentication where proportionate, restrict privileged access, apply conditional-access controls and monitor unusual sign-in activity. SMS-based one-time passcodes can add protection, but the NCSC notes that SMS was not designed to carry high-risk content and has inherent weaknesses. Higher-risk systems should therefore use stronger authentication methods where practical.

4. Secure mobile devices and applications

Apply mobile-device management, timely software updates, application controls, device encryption and remote-lock or wipe capabilities. Separate business data from personal use where appropriate, and prevent unmanaged devices from accessing sensitive services without suitable controls.

5. Strengthen payment and change controls

No payment, bank-detail change or sensitive action should rely solely on a text message. Require independent verification through an approved channel, use dual authorisation for high-risk transactions and make sure staff can challenge unusual executive or supplier requests without delay.

6. Prepare for mobile-led incidents

Incident plans should cover malicious texts, compromised mobile devices, stolen authentication codes and fraudulent payments. The organisation should define escalation routes, evidence-preservation steps, regulatory assessment responsibilities and communication procedures before an incident occurs.

What evidence demonstrates effective smishing controls?

Boards, auditors, regulators and enterprise customers may expect more than a policy statement. Useful evidence includes:

  • Documented rules for official SMS and mobile communications.
  • Approved sender IDs and communication channels.
  • Training records and role-specific exercises.
  • Phishing and smishing reporting metrics.
  • Mobile-device security standards and compliance reports.
  • Authentication and conditional-access configurations.
  • Payment-verification and supplier-change procedures.
  • Incident-response playbooks and tabletop exercise outputs.
  • Lessons learned from reported or simulated attacks.
  • Board or executive reporting on human-layer and mobile-channel risk.

Frequently asked questions

Can a text message infect a phone without being opened?

Most smishing attacks require the recipient to click a link, install an application, disclose information or take another action. However, mobile-platform vulnerabilities can occasionally be exploited with limited user interaction. Keeping the operating system and applications updated remains important.

Can a message that appears in a genuine sender thread still be fake?

Yes. Sender IDs and telephone numbers can be spoofed, and compromised accounts may be used to send fraudulent messages. Treat the content and requested action as the primary risk indicators, not merely the displayed sender name.

Is every spam text a smishing attack?

No. Spam may be unwanted marketing, while smishing is designed to deceive the recipient into revealing information, transferring money, installing software or granting access. Both should be handled cautiously, but the underlying purpose is different.

Should organisations run simulated smishing exercises?

Carefully designed simulations can test awareness, reporting and response processes. They should be proportionate, ethically governed, accessible and focused on learning rather than blame. Results should lead to targeted improvements rather than headline pass-or-fail scores.

How can IG-Smart help?

IG-Smart helps regulated and high-consequence organisations strengthen cyber governance, human-layer resilience and incident readiness. Support can include cyber resilience assessments, security governance reviews, mobile-channel risk controls, executive reporting, supplier assurance, awareness programmes and cyber incident tabletop exercises.

The objective is not simply to reduce clicks. It is to build a defensible control environment in which suspicious communications are recognised, reported and contained before they become material incidents.

Sources and further guidance