Smishing

Smishing is phishing delivered by SMS or by messaging apps. The message impersonates a bank, a delivery company, a tax office or a mobile operator and pushes the reader to tap a link or call a number. Phones show little of the real address, and people read texts quickly, which is why the format works.

How it works

Attackers buy or scrape lists of phone numbers and send short messages in bulk, through SMS gateways, compromised accounts or, in some reported cases, portable fake mobile base stations. The text gives a reason to act now: a parcel held for an unpaid fee, a suspicious card transaction, a toll or traffic fine, a tax refund. The link often uses a newly registered domain, a URL shortener, or a combosquatting domain that adds words such as track or pay to a brand name. Many smishing sites use cloaking, so they show the fake page only to mobile visitors from the targeted country and a harmless page to everyone else, which slows down detection.

Example

An illustrative case: a text says "Your parcel could not be delivered. Pay the small redelivery fee at exampleparcel-track[.]com". The site copies a courier's design and asks for name, address and card details. It then shows a fake bank verification screen to capture the one-time code that confirms the payment.

How to spot it

• An unexpected text about a parcel, a fine, a refund or a blocked account.
• A link to a domain that is not the company's usual one, or a shortened link.
• A request to pay a small fee or to confirm card details.
• The sender is an ordinary mobile number or an unfamiliar sender name.
• Pressure to act within hours.

What brands can do

• Tell customers which domains and sender names you use for texts, and that you never ask for card details by SMS.
• Where a sender ID registry exists in your market, register your sender names so they are harder to spoof.
• Monitor for domains that pair your brand with words like delivery, tracking or payment.
• Have confirmed smishing domains taken down and added to browser blocklists, and report the sending numbers to the mobile operator.

Smishing domains tend to rotate quickly, so speed matters. Phishvoid verifies these sites and files takedowns with registrars, hosts and blocklists; contact the team to set this up. For a closer look at the most common lure, read Fake parcel delivery SMS scams.

Read more: Fake Parcel-Delivery SMS and Tracking Pages: How They Work