What Is Smishing?
Smishing (SMS phishing) uses fake text messages with malicious links to impersonate banks or delivery services and steal credentials or install malware.
Smishing — SMS phishing — is a fraud technique where attackers send text messages impersonating banks, delivery services, government agencies, or other trusted institutions to trick recipients into clicking malicious links or revealing sensitive information. While robocalls and vishing (voice phishing) are the primary voice channels for senior-targeted fraud, smishing is increasingly used as a complementary attack — often as a follow-up to an unanswered call.
Common Smishing Scripts in 2025–2026
- Delivery notification: "Your USPS/FedEx/Amazon package requires action. Click here to confirm your delivery address." — Captures personal and payment details.
- Bank fraud alert: "ALERT: Unusual activity detected on your account. Click to verify." — Links to a spoofed banking login page.
- Government benefit claim: "You have an unclaimed Social Security benefit waiting." — Harvests Social Security numbers. Learn more about senior-targeted government imposter fraud.
- Two-factor authentication bypass: Scammers send a fake prompt to intercept real bank authorization tokens.
Key Defense
Never click links in unexpected text messages, regardless of the apparent sender. If a text appears to be from a real institution, navigate directly to their official website. Combining smart habits with on-device call screening helps eliminate the underlying phone fraud ecosystem that enables smishing follow-ups.
Frequently Asked Questions
What is smishing?
Smishing (SMS phishing) is a fraud technique using text messages that impersonate trusted institutions — banks, delivery services, or government agencies — to trick recipients into clicking malicious links or revealing sensitive personal information.
How do I identify a smishing text?
Look for unexpected urgency, unfamiliar short codes or phone numbers, links with misspelled domain names, and requests for information you didn't initiate. Legitimate banks and government agencies do not send unsolicited texts asking you to click links and enter credentials or personal information.
What should I do if I receive a smishing text?
Do not click any links. Do not reply. If the text appears to be from a real institution, contact that institution directly using a number or website you look up independently. Report the smishing message to the FTC at ReportFraud.ftc.gov and to your carrier by forwarding the text to 7726 (SPAM).
Stop the calls. No card required.
Callro's 26-layer Gauntlet Engine blocks robocalls, spoofed numbers, and scam callers before your phone rings. 7-day free trial.
Get Callro Free →