What Is Smishing?
Smishing is phishing carried out by text message instead of email. The name combines "SMS" and "phishing." Attackers send a text that looks like it comes from a delivery company, a bank, an internal IT department, or even a colleague, with the goal of getting the recipient to click a link, share a code, or hand over personal information.
Smishing works because text messages feel more personal and more urgent than email. People tend to trust texts more, check them faster, and rarely pause to verify the sender. A message claiming a parcel could not be delivered, or that a bank account needs urgent verification, plays on that instinct to act quickly.
Common smishing patterns include fake delivery notifications, fraudulent two-factor authentication codes, messages impersonating a manager or colleague, and links to fake login pages disguised as legitimate services.
Because smishing happens on personal devices, it often falls outside traditional email security tools. That makes employee awareness and the ability to recognize and report a suspicious text just as important as any technical filter.