What is Smishing (and How to Stay Safe)
Key takeaways:
- Smishing is a combination of “SMS” and “phishing.”
- Smishing attacks are link-based text scams, where scammers send texts with malicious links, pretending to be from reputable sources.
- Phishing and smishing are essentially the same, with phishing being done via email and smishing via text message.
Texting has made it possible for us to connect instantly with friends, family, coworkers, and even the businesses we shop from. That’s a great thing…for the most part. Unfortunately, scammers have realized that, unlike with emails that can go days without being seen or easily screened, sending a text is an almost sure-shot way to contact potential victims.
And that’s where smishing comes in — the text message variation of phishing.
What is Smishing?
To understand smishing, we first have to look at its predecessor, phishing. Phishing is an extremely popular scam where scammers send emails with links that appear to be from a reputable source like Amazon, Walmart, Verizon, Wells Fargo, etc. When you click the link, you go to a page that looks legit, but is actually a fake website designed to steal any information you enter, such as your passwords and credit card information.
Smishing works similarly, but is carried out via SMS (Short Message Service) text. That’s where the name comes from: SMS + Phishing = Smishing.
TL;DR: Smishing is a text-based form of phishing, where scammers send links claiming to be from reputable businesses in order to steal private information like passwords and credit card numbers.
Phishing vs. Smishing (vs. Vishing)
Phishing and smishing are very similar link-based scams, with the only difference being that phishing is done via email and smishing is done via text message.
Vishing, on the other hand, is voice-based phishing (thus the name), in which you receive a phone call from scammers claiming to be a reputable source like the IRS or your bank.
Ultimately, the goal and execution are the same for all three: to convince you that they are with a trusted source in order to steal your private information.
How a Smishing Attack Works
Smishing attacks work so well because people are highly likely to see them, and they are constructed in a way to instill fear or panic. Here’s the simplified breakdown:
- 1.You will receive a text containing urgent language and a link. We’ll look at a few examples of this in the section below.
- 2.If you click the link, you’ll be taken to a spoofed website that may closely resemble the real version.
- 3.Any information you enter into the website will be visible to the scammers.
Common Smishing Examples
There’s a good chance you’ve received one of these scam messages already (and hopefully you’ve never clicked on the links they contain!), but let’s look at some of the most common smishing examples.
Bank Notification Smishing Texts
Scammers will send a text claiming to be from a widely used financial institution, such as Wells Fargo, Chase, or Bank of America. The text will consist of an alert that a large amount of money was charged to or withdrawn from your account. It will then provide a link to follow if the transaction wasn’t made by you.
How to stay safe: If you don’t have any accounts with the bank the text claims to be from, that’s a strong indication it may be a scam. But even if you do have an account, do not click the link. Instead, check directly with your bank (via their official app, website, or telephone number).
Package Delivery Smishing Texts
You’ll receive a text claiming to be from a service like UPS, FedEx, DHL, or USPS stating that a problem has occurred with the delivery that requires you to click a link or provide certain personal details to resolve.
How to stay safe: Once again, if you aren’t expecting any packages, that’s a strong sign the message may not be legitimate. If you are expecting a package, contact the delivery service through its official website. Also, take a close look at the number the text message came from. Usually, legitimate shipping updates will come from shortened five-digit numbers, not a standard 10-digit phone number or, even more tellingly, an iCloud email address.
Job Opening Smishing Texts
In this new and increasingly common smishing attack, scammers send a message pretending to be a job recruiter that either wants you to fill out an application or just go ahead and hire you for an open position. The provided link will take you to a submission form that requests private information — like your social security number or bank routing information.
How to stay safe: Unless you filled out an application and have already had contact with the person reaching out, it’s wise to treat unexpected employment-related texts with caution.
Order Confirmation Smishing Texts
Similar to the bank notification smishing scam, you’ll receive a text alert confirming a purchase made on one of your shopping accounts (like Amazon, Walmart, or Best Buy). Again, a link will be provided, and the message will claim that you need to follow it if the transaction wasn’t made by you.
How to stay safe: Once again, if you didn’t make any purchases, ignore the text. You may want to check your bank transactions to double-check your account hasn’t actually been compromised, but never, ever click an unknown link.
How to Spot a Smishing Attack
By now, you should have a pretty good idea of how to spot a smishing attack, but there are a few extra red flags that may indicate a text could be a smishing attempt. Look for the following signs:
- Spelling errors and/or strange grammar
- Links or downloadable files
- Mass group texts with unknown recipients
You can learn more signs that a text message may be fishy in our full guide to spotting fake text messages.
Frequently Asked Questions About Smishing Attacks
How do I avoid falling for a smishing text?
Watch out for urgently worded text messages from numbers claiming to be financial institutions or large retailers. Similarly, be wary of text messages containing employment offers or encouraging you to apply to an open position (remember, if it is too good to be true, it is!). Keep an eye out for strange phone numbers, text messages that seem personalized but have gone out to a larger group of people, and never click on a link unless you are 100% sure it’s safe.
Why is it called “smishing”?
Smishing is a combination of “SMS” (text messages) and “phishing” (link-based email scams).
What’s the difference between smishing and phishing?
Phishing scams are done via email, while smishing is done via text message. Both scams have the same ultimate goal: to encourage you to click on a malicious link and share your private information for scammers to use in other crimes.
How can I check who a text is from?
If you’re curious who’s actually behind an unknown text, use a reverse number search tool like PeopleWin to search for the owner’s real name and location.
Cyrus Grant is a writer from Southern California with a background in law and dispute resolution. When he isn’t writing, he can be found deep-diving into the latest technology trends or simply spending time at the beach.