Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is smishing? SMS phishing explained for staff

In one sentence: Smishing is phishing by text message: a fake SMS that tries to get you to click a link or hand over a password, code or payment.

What it is

Smishing combines “SMS” and “phishing”. The Irish NCSC lists it beside email phishing and vishing as one of the three main phishing channels.

The UK NCSC explains that the purpose of a scam text is often to get you to click a link. The link leads to a site criminals use to download viruses or steal passwords and personal information. Texts feel personal and urgent, and they bypass the email filters most businesses rely on.

How it works

  1. The attacker gets phone numbers from earlier breaches or by matching staff names to numbers.
  2. They send a text that looks like a delivery notice, a bank alert, or a message from your IT team saying a password has expired.
  3. The text carries a link to a fake page, or a number to call.
  4. The victim enters a username, password and sometimes a one-time code.
  5. The attacker signs in to the real service, often in real time.
  6. They look for email, cloud files, internal tools or customer data.

Who it affects and how badly

Anyone with a mobile phone. Staff using personal phones for work are harder to protect, because company filters never see the message.

Small firms and trades run on mobiles, so a fake parcel or bank text lands on a work phone. Recruitment and estate agencies publish staff numbers. Care providers and schools text families, so staff are used to acting on messages. Larger organisations see fake IT notices aimed at single sign-on logins.

Worst case is a stolen login that opens email and cloud storage, then fraud or data theft and, for regulated firms, a breach report. UK organisations must report notifiable personal data breaches to the ICO within 72 hours of becoming aware.

Real examples

Twilio, August 2022. TechCrunch reports that Twilio confirmed hackers accessed customer data after tricking employees into giving up corporate logins. The SMS messages appeared to come from Twilio’s IT department, said passwords had expired or schedules had changed, and led to a spoofed web address. Twilio worked with US carriers and hosting providers to shut them down, but said the attackers kept rotating to new ones. Source: https://techcrunch.com/2022/08/08/twilio-breach-customer-data/

How to detect it

  • Ask staff to forward suspicious texts. In the UK most phone providers let customers forward scam texts free to 7726, so the provider can investigate and block the sender (NCSC).
  • Look for look-alike domains and odd words in the address next to an unrelated name.
  • In Entra or Google Workspace sign-in logs, look for logins from new countries or devices soon after a text.
  • If you manage phones with Intune or Google endpoint management, check for apps from unknown sources.
  • Share the numbers and links you see across the team.

How to fix or prevent it

  1. Use passkeys or FIDO2 security keys for staff. Codes sent by text can be relayed by a fake page.
  2. Tell staff that IT will never ask them to sign in through a link in a text, and publish the one real way to reach the help desk.
  3. Report scam texts to 7726, as the NCSC asks.
  4. Use managed work profiles so work sign-ins are separate from personal phones.
  5. Run smishing exercises and measure who reports.
  6. Block newly registered and look-alike domains with DNS filtering.
  7. Make clear nobody is blamed for reporting a text they clicked.

Related terms

Browse all entries in the social engineering hub.

FAQ

What is smishing? Phishing by text message. The NCSC says the purpose is often to get you to click a link to a site that steals passwords or installs a virus.

How do I report a scam text in the UK? The NCSC says most phone providers let you forward it free to 7726.

Has a real company been hit? Yes. Twilio said in 2022 that staff were tricked by texts that looked like they came from its IT department.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.