Smishing has changed a lot in the Nordics over the past five years, moving from clumsy scam texts to polished, localized attacks. This article draws on Nimblr's report, SMS Under Siege: A Five-Year Analysis of Smishing and Mobile Fraud in the Nordics, and covers three things: why smishing has taken off in the region, how modern attacks use AI and psychology, and what training and policy changes actually help. If you are new to the topic, start with what smishing is.
Why is smishing hitting the Nordics so hard?
The Nordics are an attractive target for a few reasons: very high mobile use, a strong cultural trust in text messages, and widespread adoption of digital ID systems that attackers can imitate. The scale is striking. In Sweden alone, more than 18 million fraudulent SMS messages were blocked in the first nine months of 2024, and that figure does not even include peak scam seasons.
Modern campaigns increasingly follow a TOAD pattern, short for Telephone-Oriented Attack Delivery. These attacks pair technical tactics, such as spoofed sender IDs, fake links, and deepfakes, with psychological pressure like urgency, fear, and authority to push people into acting quickly.
5 key takeaways from the report:
Smishing has professionalized. Messages are now well written, localized, and often AI-generated.
It affects every age group, not just older people.
Businesses are prime targets, especially through bring-your-own-device environments.
Technical defenses alone are not enough. User behavior is the deciding factor.
Training works. Simulated campaigns can produce up to an 80 percent drop in clicks within three months, which is why it pays to train against smishing.
What can you do?
The report lays out Nordic-specific recommendations across policy, training, incident response, and mobile security. The common thread is that smishing is a human problem as much as a technical one, so the strongest response is cross-functional, combining policy, people, and technology with a clear focus on behavior. As the report puts it, the fight against smishing cannot be left to IT departments alone. For the full data and recommendations, see the full SMS threat report.
Download the full report →
