Smishing is a text-message–based scam tactic where messages impersonate banks, companies, or government agencies to pressure people into taking action. These texts often create urgency and include links or instructions designed to steal information, money, or account access.
Smishing, short for “SMS phishing,” is a scam tactic where text messages are used to impersonate trusted organizations or contacts in order to prompt a response, extract information, or move a scam forward. Like vishing, smishing is not a single scam—it’s a delivery method scammers use across many types of fraud and relies on text messages rather than phone calls or emails.
Instead of long explanations, smishing messages are often brief and designed to feel routine, personal, or mistaken. Because texts are usually read quickly and seen as personal, they can lower skepticism, especially when the message doesn’t immediately look like a scam.
Smishing is commonly used as a first step to "hook" someone into a scammy conversation.
Scammers use smishing to:
In many cases, smishing starts a conversation that later escalates into phishing, vishing, or account takeover attempts.
Smishing messages don’t always look urgent or alarming. They generally fall into two common patterns.
These messages are designed to trigger quick action and often include a link or phone number. Examples include:
Other smishing messages are intentionally casual or ambiguous, such as:
These messages are often used to start a conversation, confirm your number is active, or build familiarity before introducing a scam.
Smishing is a flexible tactic that can be adapted to nearly any type of scam. Scammers regularly reuse text messages to support new schemes as well as familiar fraud patterns.
Some commonly reported scam categories that often involve smishing include:
These examples aren’t exhaustive. Smishing messages are frequently adjusted to match current events, popular services, or personal details, which is why recognizing the tactic matters more than memorizing specific scam types.
Text messages give scammers several advantages that other channels don’t.
Smishing allows scammers to:
Because smishing campaigns can be sent at mass scale, scammers don’t need every message to succeed, they just need a small number of responses to move scams forward.
In some cases, scammers also use AI-generated wording or scripts to make messages sound more natural, personalized, or conversational. This can make scam texts feel less roboticand grammatically correct, which makes them harder to distinguish from legitimate messages.
If a text nudges you to respond without context, that’s a good reason to pause.
What is smishing?
Smishing is a scam tactic where text messages are used to prompt responses, clicks, or actions that support fraud.
Are smishing messages always urgent?
No. Some smishing messages are intentionally vague or conversational to start a dialogue or confirm a number is active.
How is smishing different from phishing or vishing?
Smishing uses text messages, phishing typically uses email, and vishing uses phone calls.
What should I do if I receive a suspicious text?
Don’t click links or reply. Verify the message by contacting the organization directly using official contact information.
