Smishing: how SMS phishing works and how to fight it

Phishing did not stay in the inbox. Smishing — phishing by SMS and messaging apps — has become one of the most effective lures around, precisely because it lands on the device where people are most distracted and least able to check. Here is how it works and what a brand can actually do about it.

How a smishing attack works

The pattern is simple and fast:

• Impersonation — the text claims to be from a bank, courier, tax office or service you recognise.
• Urgency — "your parcel is held," "suspicious login," "verify within 24 hours" to short-circuit caution.
• A link or number — tapping leads to a fake login or payment page; calling connects to a scammer.

Why mobile makes it worse

Smishing exploits the phone itself. Mobile browsers truncate the address bar, so a lookalike domain is hard to inspect. People read texts on the move, between other tasks. And the pages behind smishing links are often cloaked, showing a clean page to any scanner while serving the real credential trap to the targeted phone.

What a brand can do

1. Monitor for lookalike domains and cloned pages used in smishing against your brand.
2. Resolve the cloak by crawling as both a scanner and a real mobile device.
3. Capture evidence and take the page down so the link in every text goes dead.
4. Tell customers plainly which channels you will and won't use, so unexpected texts look wrong.

The takeaway

Smishing works because a text feels personal and a phone is hard to vet. You cannot stop the messages, but you can kill what they point to. Watch for the clones, defeat the cloaking, and take the pages down — and every smishing link in your name becomes a dead end.