Smishing: SMS Phishing Explained

Smishing, short for SMS phishing, is phishing delivered by text message. A scam text pretends to come from a trusted organisation and pushes you to tap a link, hand over login or card details, or call a number controlled by the criminal. It works because phones feel personal, the small screen hides the real web address and messages are read on the move.

What is smishing and how does a smishing attack work?

The word joins SMS and phishing. It is one branch of the wider phishing family, alongside vishing (voice calls) and quishing (QR codes). Scams on WhatsApp and other messaging apps work the same way and are usually grouped with it.

A typical smishing attack runs in three steps:

1. The text. Criminals send messages in bulk, or to numbers taken from a data breach, often with a spoofed sender name such as a bank or delivery firm.
2. The pressure. The message gives a reason to act now: a missed parcel, a payment to approve, an account about to close.
3. The payoff. The link opens a convincing copy of the real site that collects logins, card details or a one-time code, or asks you to install an app. Some texts instead give a number to call, where a fake fraud team takes over.

SMS phishing differs from email phishing mainly in where it lands. Texts get far less filtering than a company inbox, sender names are easy to fake, and a phone screen shows little of the real web address.

What do smishing texts look like? UK examples

They copy organisations people expect to hear from, and shift with the season and the news. These smishing examples are typical of the scam texts sent to UK phones:

How do you spot a smishing message?

Most share a few signs:

• Urgency or a threat: pay today, act within 24 hours, or lose access.
• A link where you would normally use an app, often shortened or on a lookalike domain.
• A request for card details, a password or a one-time code, which genuine organisations do not ask you to hand over by text.
• A small fee, low enough that people pay without thinking.
• A number to call that is not the one on the organisation’s website or your card.

Sender names can be spoofed, so a scam can land in the same thread as genuine messages. Ignore the link and number in the text and contact the organisation through its app, its website typed by hand or the number on your card.

Why is smishing a risk for businesses?

Because staff phones carry work access, and texts usually skip the filtering that protects company email.

• Account takeover. A fake “IT” or “Microsoft” text leads to a convincing login page. Some phishing kits relay what you type to the real service in real time, capturing the one-time code too. Passkeys and FIDO2 security keys resist this; our guide to Cyber Essentials MFA requirements covers where text message codes still fit.
• Payment fraud. A text claiming to be the managing director or a supplier asks for an urgent payment or gift cards, the mobile version of business email compromise.
• Combined attacks. A text primes the target, then a fake “IT” or “bank” call talks them into reading out a code or approving a sign-in.

How do I report a smishing text in the UK?

Forward the text, free, to 7726, then delete it; do not tap the link or reply. Your mobile provider can investigate and block or ban the sender, and the NCSC guidance on reporting scam texts suggests contacting your provider if 7726 does not work. A text claiming to be from HMRC can also be forwarded to 60599, charged at your network rate (HMRC guidance).

If you have lost money, shared bank details or used a work phone or account, follow the UK reporting routes for phishing, which cover your bank, Report Fraud and reporting at work.

What should staff be told about smishing?

1. Never share a one-time code with anyone, including someone who says they are from IT or the bank.
2. State plainly how IT will and will not contact staff, so a text that breaks the pattern stands out.
3. Report first and delete second, and thank people for reporting, even after a click.
4. Check payment or bank detail changes through a known number, never one supplied in the message.

A phishing simulation measures who clicks and, just as usefully, who reports. If a test is to reach staff phones, agree in writing which numbers are in scope, and avoid lures built on people’s private lives.

Why Sovereign Secure?

Sovereign Secure is a PCI SSC-approved QSA company and ISO 27001 certified. Our social engineering testing measures how staff respond to phishing emails, phone pretexts and, where in scope, physical visits, with every scenario agreed in advance.

To find out how your team responds to real lures, request a penetration testing quote, or browse the rest of our cyber security glossary.