Smishing Defense: Stopping SMS Phishing

Smishing — phishing via SMS text messages — surged 40% in 2025 and now accounts for 14% of all scam claims. The reason for its growth is simple: smishing click-through rates range from 19-36%, dwarfing email phishing’s 2-4% rate. People trust text messages more than email, read them faster, and have fewer tools to inspect links on mobile devices.

The APWG documented smishing as a rising threat throughout 2025, and 41% of phishing incidents now involve multi-channel attacks combining SMS, email, and voice calls.

Why Smishing Works

Mobile Interface Limitations

Mobile browsers truncate URLs, hiding the domain that would reveal a phishing site on desktop. Mobile email clients show display names but not email addresses. There is no “hover to preview” on a touchscreen. These interface constraints are exactly what attackers exploit.

Higher Trust in SMS

People associate text messages with personal communication from known contacts, banks, and service providers. Email spam filters have trained users to expect malicious email; no equivalent conditioning exists for text messages.

Immediacy Bias

Text messages demand immediate attention. The average SMS is read within 3 minutes of receipt, compared to hours or days for email. This compressed decision window reduces the time available for critical evaluation.

Bypass Email Security

SMS bypasses every email security control: DMARC, email gateways, URL sandboxing, and attachment scanning. Organizations that have invested heavily in email security may have no equivalent protections for the SMS channel.

Common Smishing Lures (2025-2026)

Toll and Parking Fee Notices

“You have an unpaid toll of $6.99. Pay now to avoid a $50 late fee.” These surged across the US in 2025, impersonating E-ZPass, SunPass, and state toll authorities. The small amount makes payment seem harmless.

Package Delivery Notifications

“USPS: Your package cannot be delivered. Update your address here.” With widespread online shopping, package delivery lures have high relevance across demographics.

Bank Fraud Alerts

“Suspicious transaction detected on your account ending in 4521. Reply YES if authorized or click to secure your account.” These exploit fear and urgency while mimicking legitimate bank notifications.

Two-Factor Authentication Intercepts

“Your verification code is 847291. If you did not request this, click here.” Attackers trigger real 2FA prompts, then use the smishing message to harvest the code. This is why phishing-resistant MFA (FIDO2/passkeys) is essential.

Government Impersonation

“IRS: Your tax refund of $1,247 is pending. Verify your identity to receive payment.” Government impersonation carries the authority principle at its strongest.

Detection Techniques

Red Flags in SMS

Unknown or short code senders you have not opted into
URLs in text messages from purported organizations (banks, IRS, shipping)
Urgency language (“immediate action required,” “account suspended”)
Requests for personal information via text
Poor formatting — legitimate organizations proofread their SMS templates

Verification Steps

Do not click links in unexpected text messages — go directly to the organization’s app or website
Check the sender — legitimate banks send from short codes you opted into, not random phone numbers
Call the organization using the number on their official website or app, not the one in the message
Forward suspicious texts to 7726 (SPAM) — this reports them to your carrier
Search the message text online — known smishing campaigns are widely reported

Protection Measures

For Individuals

Action	Implementation
Enable carrier spam filtering	AT&T ActiveArmor, T-Mobile Scam Shield, Verizon Call Filter
Forward smishing to 7726	Reports to carrier for blocking
Use official apps	Access banking, postal, and government services via apps, not SMS links
Enable phishing-resistant MFA	FIDO2 keys eliminate SMS-based 2FA hijacking
Install mobile security	Lookout, Zimperium, or similar mobile threat defense
Block and report	Block suspicious numbers and report to FTC

For Organizations

Mobile device management (MDM) for corporate devices — enforce security policies and threat detection
Security awareness training with smishing-specific simulations
SMS authentication migration — replace SMS-based 2FA with FIDO2/passkeys across the organization
Policy guidance — establish clear rules about what the organization will and will not communicate via SMS
Communicate these policies — tell employees and customers “We will never ask for passwords or financial data via text”

Reporting Smishing

Forward the message to 7726 (SPAM) — your carrier will investigate
Report to FTC at reportfraud.ftc.gov — see our reporting guide
Report to FBI IC3 at ic3.gov if financial loss occurred
Report to the impersonated organization — banks, shipping companies, and government agencies want to know about brand abuse
Block the sender on your device
Report to CISA at [email protected] for campaigns targeting critical infrastructure

Smishing and Vishing: The Multi-Channel Attack

Modern attacks chain smishing with vishing (voice phishing). A typical sequence: the victim receives a smishing text about a “suspicious transaction,” then receives a follow-up phone call from the “bank’s fraud department.” The text creates urgency; the call harvests credentials. Defending against multi-channel attacks requires awareness across all communication channels.

Key Takeaways

Smishing click rates (19-36%) far exceed email phishing (2-4%) due to mobile trust and interface limitations
Never click links in unexpected text messages — navigate to apps or websites directly
Forward suspicious texts to 7726 (SPAM) to help carriers block campaigns
Replace SMS-based 2FA with phishing-resistant MFA (FIDO2/passkeys)
Smishing frequently chains with vishing for multi-channel attacks
Report smishing to your carrier (7726), the FTC, and the FBI IC3

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

Security education disclaimer: This article describes smishing attack techniques for educational purposes only. Understanding how SMS phishing operates helps individuals and organizations build effective defenses. Do not use this information for unauthorized purposes.