Smishing, a blend of "SMS" and "phishing", is a phishing attack delivered by text message. The message impersonates a bank, delivery firm, government body or employer and urges the recipient to tap a link, reply with details or call a number.
Why it matters
People tend to trust and quickly read text messages, and the small screen hides details such as the full link. Messages are short and urgent, which discourages careful checking. Mobile devices also sit outside many corporate email filters, so protection that works for email may not apply.
Example
A text says: "Your parcel is held. Pay a small fee at the link to reschedule delivery." The link leads to a look-alike page asking for card details. The safer route is to ignore the link, open the courier's official app or type its known address directly, and check whether a delivery really exists.
Common mistakes
- Trusting the sender name, because sender IDs can be spoofed.
- Replying "STOP" to unknown messages, which can confirm that the number is active.
- Tapping shortened links without checking where they lead.
- Not reporting the message to the carrier or the impersonated organisation.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.