18 million blocked scam messages: Smishing in the Nordics is growing.

Over the past five years, smishing has evolved from a fringe tactic into one of the most lucrative and hard-to-detect cyber threats in the Nordics. Nimblr’s latest report, SMS Under Siege: A Five-Year Analysis of Smishing and Mobile Fraud in the Nordics, reveals how this attack method has matured, and why organizations need to act now. 

This article contains: 

• Insights on why smishing is rising fast in the Nordics 

• Findings on how modern smishing uses AI and psychological tricks 

• Nordic-focused tips for boosting resilience through training and policy 

Download the full report 
(https://nimblrsecurity.com/report-sms-under-siege-nimblr)

Why is smishing hitting the Nordics so hard? 

It’s not just bad luck. The Nordics have created an ideal environment for SMS-based fraud: high mobile penetration, strong trust in text communication, and widespread use of digital ID systems. In Sweden alone, more than 18 million fraudulent SMS messages were blocked in the first nine months of 2024, and that number doesn’t include peak shopping seasons like Black Week and Christmas. 

"The fight against smishing can’t be left to IT departments alone"

The report explores how today’s smishing attacks go beyond simple text deceptions. Criminals now combine technical tactics (spoofed sender IDs, fake links, deepfake voices) with psychological manipulation (urgency, fear, authority) in a method known as TOAD: Telephone-Oriented Attack Delivery. 

5 Key takeaways from the report: 

• Smishing has gone professional. Messages are well-written, localized, and often generated using AI.
• All age groups are now at risk. What once targeted the elderly now affects digital natives in hybrid work setups.

• Businesses are a prime target. Bring-your-own-device (BYOD) environments allow one click to open the door to corporate systems.
• Technical defenses aren’t enough. Tools like MDM and MTM help; but user behavior is still the deciding factor.
• Training works. Organizations using simulated smishing campaigns see up to an 80% drop in clicks within three months. 

What can you do? 

The report provides practical, Nordic-specific recommendations across policy, training, incident response, and mobile security. But above all, it makes one thing clear: smishing is a human problem, not just a technical one. Building a strong security culture in which users can recognize, report, and resist attacks is essential. 

The fight against smishing can’t be left to IT departments alone. It requires a cross-functional approach that combines policy, people, and technology with a strong emphasis on behavior.  

Smishing is evolving. Your defense strategy should, too. Let us show you how to turn awareness into resilience. 

Download the full report to explore our insights, data, and recommendations. (https://nimblrsecurity.com/report-sms-under-siege-nimblr)