Smishing in plain English
The term is a blend of “SMS” and “phishing.” In phishing, scammers use fake emails to lure their victims to counterfeit websites. Smishing works the same way, just with text messages – sent by SMS or through messaging apps on a smartphone.
Typical examples include supposed delivery notices (“Your package could not be delivered”), warnings from the bank, or messages that claim to come from senior management. They all have the same goal: getting you to tap a link, install an app, or call a number back.
Picture a fake delivery slip in your mailbox. It looks like it came from the parcel service, carries the right logo, and makes an urgent request. But anyone who calls the number on it doesn’t reach the parcel service – they reach the scammer. Smishing applies the same principle on your phone.
How smishing works
A smishing attack usually unfolds in four steps:
- Collecting numbers: The perpetrators use phone numbers from earlier data leaks or from publicly available sources such as company websites and online profiles. Some simply text random numbers.
- Choosing a pretext: The message creates pressure or curiosity – a package, a blocked account, an expiring password, or the boss’s supposedly new number.
- Redirecting the victim: A shortened link leads to a fake login page, a payment page, or the download of a malicious app. If the victim is asked to call back, the attack continues over the phone as vishing.
- Cashing in: Using the stolen passwords and codes, the perpetrators sign in and, for example, trigger payments. If the victim installs the supposed app, malware – malicious software – lands on the smartphone. It can, for instance, intercept messages and verification codes.
What makes smishing especially treacherous: attackers can spoof the sender name of a text message. The fraudulent message may then appear in the same thread as genuine messages from your bank. Then there’s the small screen. Links are displayed in shortened form, and security filters are less likely to kick in on a smartphone than in an email inbox.
A practical example
One evening, an employee of a plumbing supplies wholesaler receives a text: “Your company password expires today. Renew now to avoid being locked out.” A link is included. The page looks just like the company’s familiar login page.
He enters his username and password – and then the verification code that arrives by text moments later. That code really was sent by the company’s system: in the background, the attackers immediately used his entries on the real login page. Now they have everything they need. They sign in to his email account and use it to send fraudulent invoices to customers.
The attack only came to light when a customer got in touch to ask about it. A clear reporting channel for suspicious messages and a phishing-resistant sign-in method could have prevented the damage or at least contained it early.
Why does this matter for businesses?
Smartphones have long been work devices. They run email, chat, apps for sign-in codes (authenticator apps), and access to cloud services. Anyone who deceives employees via their smartphone can therefore often get straight to company accounts – bypassing email filters and firewalls.
On top of that, many employees read work messages on personal devices that fall outside central security controls. And smishing doesn’t just target passwords. Fake payment instructions in the name of senior management – such as an urgent request to buy gift cards – also cause real financial damage.
How to protect your organization
- Set a clear rule: Links in unexpected text messages don’t get tapped. Check a delivery status, account balance, or password directly via the official app or website.
- Never share codes: Verification codes and passwords stay secret – even from supposed IT support or senior management.
- Verify via known numbers: For unusual requests, such as payments, call the person back on a number you already know – never on the number in the message.
- Use phishing-resistant sign-in: For multi-factor authentication, rely on FIDO2 security keys or passkeys instead of SMS codes wherever possible. They only work on the genuine website – on a fake page, they’re useless.
- Manage company phones: Central device management (mobile device management, MDM) can, for example, block the installation of apps from unknown sources.
- Create a reporting channel: Employees should be able to report suspicious messages easily and without fear of blame.
- Raise awareness regularly: Training and realistic exercises make people familiar with the scams before a real attack happens.
How Rootsektor can help
Smishing is a form of social engineering: instead of technical flaws, the perpetrators exploit trust and time pressure. With Security Awareness & Phishing Simulation, we train your team in a hands-on way – on request with smishing exercises that show how well awareness holds up in everyday work. We don’t expose individual employees in the process. Realistic scenarios under Social Engineering & Physical Testing test whether processes such as callbacks and approvals hold up, too.