What is smishing?
Smishing is phishing by text message. The word joins SMS and phishing. A criminal sends a message that looks like it comes from a bank, a courier, a government office or an employer, and tries to make you click a link, call a number or reply with a one-time code. Because people read nearly every text, and read it within minutes, the tactic works well.
This guide shows how smishing attacks are built, the warning signs that give them away, what to do if you have already clicked and how businesses can protect both customers and their own brand. If you send messages for a living, the second half matters most: every fake text that borrows your name damages trust in your real ones. The wider topic is described under SMS phishing.
How a smishing attack works
- The attacker gets numbers. They buy leaked lists, generate numbers at random or target people from a data breach.
- They write a convincing message. The text uses a brand name, a deadline and a threat or a reward to create urgency.
- They send at scale. Messages go out from SIM boxes, hacked accounts or abused messaging routes, often spoofing a sender name.
- You click or reply. The link leads to a fake site that copies a real one, or the message asks you to call or reply.
- They take what you give. Passwords, card numbers, OTPs or payments are used straight away, often within minutes.
Spotting a smishing message
| Warning sign | Why it matters | What to do |
|---|---|---|
| Unexpected message about money, parcels or accounts | Scammers choose topics that make you act fast | Ignore the message; check in the official app |
| Urgency or a threat | Pressure stops you thinking | Slow down; real organisations give time |
| A link that looks slightly wrong | Fake domains imitate real ones with extra words or odd endings | Never tap; type the known address yourself |
| A request for a code, PIN or password | No real service asks for these by text or phone | Never share; report it |
| Sender is a mobile number, not a registered name | Many genuine businesses use registered senders | Treat as unverified |
| Poor spelling or odd phrasing | Often copied from a template or translated badly | Treat as a red flag, not as proof |
A good rule. If a message makes you feel rushed, frightened or excited, stop. That feeling is the attack. Verify using something you already trust, not the link or number in the message.
Common types of smishing
- Delivery scams. "Your parcel could not be delivered, pay a small fee."
- Bank and KYC alerts. "Your account will be blocked unless you update details now."
- Government and tax messages. Refunds, fines or benefits that need a quick payment or a login.
- Prize and offer scams. Winnings that require a fee or personal details.
- OTP theft. The attacker triggers a real code and asks you to read it back.
- Boss and gift card fraud. A message pretending to be your manager asks for urgent vouchers.
- Job and investment scams. Easy income for a deposit or a small task.
Smishing, phishing and vishing compared
| Phishing | Smishing | Vishing | |
|---|---|---|---|
| Channel | SMS and messaging apps | Phone calls | |
| How it reaches you | Inbox, often filtered | Phone, read within minutes | A call or voicemail |
| Typical hook | Account alert or invoice | Delivery fee, bank alert, prize | A fake agent or official on the line |
| Main defence | Email filtering | Verify sender and never tap links | Hang up and call back on a known number |
| Scale for attackers | Very high | High and rising | Lower, more manual |
The channels are often combined. A text may tell you to call a number, where a person continues the scam, or an email may be followed by a text to add pressure. Treat a message on any channel with the same habit: stop, verify through a route you already trust, and report it.
What to do if you clicked or replied
- Do not enter or send anything more. Close the page.
- If you typed a password, change it at once from a clean device, and anywhere else you used it.
- If you shared card or bank details, call your bank on the number printed on your card and ask them to block and monitor.
- Turn on two-factor authentication for your important accounts; see our guide to SMS 2FA.
- Scan your phone for unknown apps if you installed something from the link.
- Report the message and number to your operator and to the authority in your country.
In India, the national cybercrime reporting portal at cybercrime.gov.in and the helpline 1930 handle financial fraud reports, and reporting quickly improves the chance of freezing a transfer. In other countries, your bank and national consumer or cyber agency run similar services, such as the US Federal Trade Commission.
How businesses can stop smishing in their name
When criminals impersonate your brand, customers blame you as well as them. You cannot stop every fake, but you can make the real messages easy to recognise and the fake ones easy to remove.
| Action | What it achieves |
|---|---|
| Use a registered sender ID or a consistent number | Customers learn what your real messages look like; see SMS sender IDs |
| Register templates and senders where required | Operators can block unregistered copies; see DLT registration and 10DLC |
| Keep every link on your own domain | Customers can check one familiar address |
| Say what you will never ask for | A line like "We never ask for your OTP" in your messages and site |
| Protect your OTP flow | Short expiry, attempt limits and warnings in the message; see OTP best practices |
| Monitor and report abuse | Report fake numbers and domains to operators, registrars and authorities |
Telnxo helps with the first four through registered senders, template controls and our messaging policy. If you spot abuse of our network, report it on the abuse page. Our compliance overview explains how we vet traffic.
A safer OTP message
Telnxo: 482913 is your verification code. It expires in 5 minutes.
Never share this code. Telnxo will never ask for it by phone, text or email.A short warning in the message itself reaches people at exactly the moment they are being targeted, and costs nothing but a few extra characters. Check the length with the segment calculator so it stays within one segment.
Teaching customers and staff
Technology controls help, but people are the last line of defence. Tell customers, on your site and in onboarding messages, how your real messages look: the sender name they will see, the domain your links use and the things you will never ask for. Run short awareness sessions for staff, especially anyone who handles payments or customer accounts, because attackers often target employees with fake messages that look like they come from a manager or supplier. A simple reporting habit, such as forwarding suspicious messages to a shared mailbox, gives your security team early warning of campaigns that use your name.
Smishing succeeds when we act before we check. Build habits, and messages, that make checking easy.
Protect your brand on every message. Talk to us about registered senders, template controls and abuse monitoring.
Frequently asked questions
What is smishing?
Smishing is SMS phishing: a scam where criminals send text messages that pretend to come from a trusted organisation to trick you into clicking a malicious link, sharing a code or paying money.
How is smishing different from phishing?
Phishing is the general term and usually means email. Smishing uses text messages. The aim is the same, to steal credentials, money or personal data, but texts feel more personal and are read more quickly.
What are common smishing examples?
Fake delivery notices asking for a fee, bank alerts about a blocked account, messages claiming a tax refund or a prize, fake toll or fine notices, and messages from supposed bosses asking for gift cards.
What should I do if I clicked a smishing link?
Do not enter any details. If you did, change the affected passwords from a clean device, turn on two-factor authentication, call your bank, and watch your accounts. Report the message to the relevant authority.
Can smishing steal my OTP?
Yes. Criminals often trigger a real login or payment and then text you pretending to be the service, asking for the code you just received. A real organisation will never ask for your OTP.
How can businesses stop smishing in their name?
Use registered sender IDs, send from consistent numbers and domains, keep links on your own domain, tell customers what you will never ask for, and report fake numbers and websites for takedown.
Is smishing illegal?
Yes, in nearly every country. It is fraud and often also breaches computer misuse and telecom laws. Report it so the numbers and sites can be blocked.