• Overview
    • Scam Map
    • Kill Chain
Recents

    Conversations will appear here

Technique

Smishing

Also known as: SMS Phishing, Text Phishing, Text Message Scam, Text Scam

DELIVERY

SMS-based phishing using text messages with malicious links or urgent requests.

Common attack flows

How it fits in a scam

This technique shows up duringDELIVERY

Before

  • Data Breach HarvestingTARGETING
  • Social Media ReconnaissanceTARGETING
  • Data BrokersTARGETING

After

  • Malicious App InstallationCOMPROMISE
  • MalwareCOMPROMISE
  • Payment Card TheftCOMPROMISE

Defense

How to defend against this

How to spot it

  • Unknown sender or unfamiliar short codes/phone numbers
  • Generic greetings (Dear Customer or Sir/Madam) instead of your name
  • Spelling errors or grammatical mistakes or odd formatting
  • Urgent language demanding immediate action or threatening consequences
  • Requests for personal info (SSN or passwords or bank details) via text
  • Suspicious shortened URLs or links to unfamiliar domains
  • Claims from entities that dont normally contact you by text (IRS or FBI)
  • Unsolicited prize/gift notifications requiring action to claim
  • Package delivery notifications you werent expecting

Tools you can use

  • SMS Spam FilteringCost low · Effect medium
  • Scam ScannerCost low · Effect medium
  • Mobile Security AppCost low · Effect high

Steps you can take

  • Direct Source VerificationCost low · Effect high
  • Official Channel VerificationCost low · Effect high
  • Official App Store OnlyCost low · Effect medium
  • Verify HTTPS ConnectionsCost low · Effect medium

Further reading

  • FTC Consumer Advice

    How to recognize and report spam texts

  • FCC

    Consumer warning on smishing

  • Malwarebytes

    Definition and overview

  • IBM

    Detailed explanation with toll scam example

  • National Cybersecurity Alliance

    Consumer protection guide

Related techniques

Variants

  • Phishing Email
  • Package Delivery Scam

Same stage

  • Vishing
  • Deepfake Voice Call
  • SEO Poisoning
  • Quishing
  • Fake E-commerce Site
  • +14 more

Similar defense

  • Remote Access Tool
  • Clipboard Hijacking
  • Malicious App Installation
  • Social Media Reconnaissance
  • Overlay Attack
  • +18 more