Smishing is a form of social engineering that uses SMS, or text, messages. The word combines SMS and phishing. CISA says the messages can contain malicious links, email addresses or phone numbers, and a link may lead to a fake website, so a single tap can start the harm.
- Also Called2other namesSMS phishing · text message phishing
- Related Terms3linked entriesPhishing · Vishing (voice phishing) · Social engineering
What is smishing?
CISA says smishing is a form of social engineering that exploits SMS, or text, messages. Social engineering means tricking people into doing something, rather than breaking into a system by technical means. The word smishing comes from SMS and phishing. Phishing is fraud in which the sender poses as a trustworthy organization to get personal information.
How does smishing work?
The UK NCSC says phishing is when attackers send scam emails or text messages that contain links to malicious websites. A smishing message is the text message version of this. The message asks the person to tap a link. The link may lead to a fake website.
Why does it matter?
A text message arrives on a personal phone, and it can reach people outside the usual email filters of an organization. This is cautious reasoning and not a measured fact. Because a message can carry a link to a malicious website, a single tap can start the harm. NCSC also advises against blaming users for clicking on links, so defense should not rely on users alone.
How can you spot and reduce smishing?
CISA advice for phishing in general also applies to messages on a phone.
- Confirm requests independently, using contact details from a trusted source and not the ones in the message.
- Be careful with links. CISA says a link that does not match the text it shows may be spoofed.
- Avoid sharing personal data in reply to an unsolicited message.
- Turn on multifactor authentication where you can, as CISA recommends.
NCSC also says organizations should have a clear, simple and quick way for users to report phishing, and should give feedback on what was done with the report.
Is smishing the same as phishing?
Smishing is one kind of phishing. Phishing is the wider term for fake messages and sites that steal information. Smishing is the version delivered by text message.
Is smishing the same as vishing?
No. Smishing uses written text messages. Vishing uses voice calls. Both are social engineering, and both try to trick people into acting.
Related pages in the Knowledge Hub
Sources
- CISA: Smishing is a form of social engineering that exploits SMS or text messages; phishing poses as a trustworthy organization; check links, verify sender, do not reveal….
- UK NCSC: Phishing is when attackers send scam emails or text messages containing links to malicious websites; reporting process; no training can teach users to spot every phish.
Also Called.
- NameSMS phishing
- Nametext message phishing
Questions.
-
What is smishing?
Smishing is a form of social engineering that uses SMS, or text, messages. The word combines SMS and phishing. CISA says the messages can contain malicious links, email addresses or phone numbers.
-
How can you spot a smishing message?
CISA advises confirming requests independently, using contact details from a trusted source and not the ones in the message. A link that does not match the text it shows may be spoofed.
-
Is smishing the same as phishing?
Smishing is one kind of phishing. Phishing is the wider term for fake messages and sites that steal information, and smishing is the version delivered by text message.
In Our Research
- 1 ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026
- 2 Smishing Triad: A Global Cybercrime Syndicate Targeting Postal and Financial Networks January 2026
- 3 Germany Threat Landscape Report June 2025
- 4 Defending Against Multi-Vector Cyber Attacks July 2024
- 5 How to Monitor and Protect Your Brand from Phishing Attacks July 2024
- 6 How to Monitor and Defend Against Phishing Attacks with Brandefense June 2024