Smishing

What it is

Smishing blends SMS and phishing. Scammers send texts that look like alerts from banks, carriers, delivery companies, or government agencies. Because texts feel personal and urgent, people often tap before they pause.

The goal matches other phishing: steal logins, one-time codes, payment details, or enough personal data to open accounts or take over ones you already have.

How it works

1. Bait — A short text claims a package problem, account lock, unpaid toll, prize, or security alert.
2. Hook — A shortened or lookalike link, or a number to call support.
3. Trap — A mobile page or caller asks you to sign in, pay a small fee, or read back a code.
4. Payoff — Credentials or funds are stolen; sometimes the text is step one before a vishing call or account takeover.
5. Attackers also spoof or spoof — adjacent sender names so the thread looks familiar at a glance.

Red flags

• Texts from your bank or carrier you did not expect, especially with a link
• Urgency: Account suspended, Pay now, Confirm within 15 minutes
• Shortened URLs or domains that do not match the real brand
• Requests to share a one-time passcode you just received
• Asks for SSN, full card number, or remote-access app install by text
• A message that does not use your usual account nickname or last digits correctly

What to do if you’re targeted

• **Do not tap the link.** Delete the text or mark it as junk/spam in your messaging app.
• **Verify through a channel you trust** — official app, saved number, or website you type yourself.
• **If you already tapped and signed in:** change the password, enable MFA, and check for new devices or transfers.
• **If you shared a code or payment info:** contact your bank or carrier immediately.
• **Report** smishing to your carrier (many support forwarding spam texts) and to ReportFraud.ftc.gov (U.S.).
• **Optional check-in:** a free identity scan can help you see whether personal details may already be circulating.

Related terms

• Phishing
• Vishing
• Account takeover