Smishing

Smishing is phishing conducted through text messages. The word combines SMS and phishing. A fraudster sends a message that appears to come from a bank, delivery company, tax authority, mobile network, toll operator or other trusted organisation, urging the recipient to click a link, call a number or reply. The goal is to obtain card details, online banking credentials, one-time passcodes or personal information, or to persuade the victim to send money.

Smishing belongs to a family of social engineering attacks that differ mainly by channel: email phishing, vishing by voice call, and smishing by text. The term now also covers messages sent through chat apps and messaging services, not only SMS. Attacks often combine channels, for example a text that prompts the victim to call a fake fraud line, where the scam continues by phone.

A typical smishing attack follows a pattern. Criminals obtain large lists of phone numbers, from data breaches, marketing lists or simply by generating numbers. They send messages in bulk, often using spoofing to make the sender name appear as a real organisation, so the message may even appear in the same thread as genuine messages from that company. The text creates urgency, such as a blocked account, a missed parcel, an unpaid toll or a suspicious payment, and directs the victim to a convincing fake website or phone number.

On the fake site, the victim enters login details, card numbers or personal data, which are captured in real time. Fraudsters may then log in to the victim's real account, trigger a one-time passcode and ask the victim to enter it on the fake page, defeating two-factor authentication.

Smishing messages exploit everyday situations:

• Bank alerts. Messages claiming a suspicious transaction or a locked account and asking the customer to verify details.
• Parcel delivery. Notices that a package could not be delivered and a small redelivery fee is due.
• Tolls and fines. Claims of unpaid road tolls, parking fines or traffic penalties with a payment link.
• Tax and benefits. Messages offering refunds or threatening penalties from tax or social security agencies.
• Family emergencies. Texts pretending to be a child or relative with a new number who urgently needs money.
• Prizes and jobs. Offers of rewards, refunds or remote work that require an upfront payment or personal data.

Smishing feeds several types of payment fraud. Stolen card details are used for online purchases or loaded into mobile wallets. Stolen banking credentials enable account takeover, after which fraudsters move money to money mule accounts. In other cases the victim is persuaded to send money directly, which is a form of authorised push payment fraud and may be harder to recover. Smishing can also be the first step of a SIM swap, when fraudsters gather enough personal data to take over the victim's phone number.

Defences operate at several levels. Mobile network operators filter suspicious messages and block known scam numbers and sender IDs, and several countries have created registries that stop unregistered organisations from using brand names as sender IDs. Banks avoid sending links in texts, warn customers that they will never ask for passcodes, and use risk-based authentication and device checks to spot logins from fraudsters. Some banks now include the purpose of each passcode in the message, so customers can see if it is being used to approve a new device or payment.

Individuals are advised not to click links in unexpected messages, to contact organisations through official apps or numbers, and never to share one-time passcodes. In the United Kingdom, mobile users can forward spam texts to 7726, a short code supported by networks, and similar reporting services exist elsewhere. Victims should contact their bank immediately, since rapid action improves the chance of freezing funds.

Laws on who bears losses vary. Card fraud following smishing is generally covered by consumer protections on unauthorised transactions, unless the bank shows the customer acted with gross negligence. Authorised payments made by deceived customers have historically been harder to recover, although some jurisdictions, including the United Kingdom, have introduced mandatory reimbursement rules for many APP fraud cases. Telecom regulators and data protection authorities also act against companies that send unsolicited messages, and law enforcement has targeted the criminal services that sell smishing kits and bulk messaging.