Smishing

The other day, I got a text that said: “Your package is arriving! Track it here,” along with a very suspicious link. The thing was, I had actually ordered something. Though I feel like I do a good job of not over-ordering things online, in retrospect, the odds that I’m waiting for a package at any given time—whether it’s a postcard, a prescription, or my monthly delivery of vegan protein powder—are higher than not. At that moment, I felt like it must be about the package I was waiting on; I had just been wondering when it would arrive, so it was probably a sign! I nearly clicked, but something stopped me. That second of hesitation is exactly what scammers count on. In a world where our phones buzz constantly with updates, alerts, and appointments, a well-timed text message can slip through our mental defenses and lead us somewhere dangerous before we’ve even had breakfast.

Welcome to the world of smishing, a word which mashes together “SMS” and “phishing,” and describes a form of cybercrime that uses text messages to deceive recipients into revealing personal information, clicking malicious links, or downloading harmful software. Smishing is a social engineering tactic, meaning it exploits human psychology rather than technical vulnerabilities. Much like phishing emails, smishing messages are designed to appear urgent, trustworthy, or enticing, often mimicking banks, delivery services, tech companies, or government agencies to manipulate the recipient into taking immediate action.

Smishing attacks have grown rapidly in recent years, driven by the ubiquity of smartphones and the increasing reliance on SMS for tasks like two-factor authentication, appointment reminders, and customer service interactions.¹,² These scams often exploit the intimacy and immediacy of text messaging—most of us check and respond to texts far faster than emails, and we tend to trust them more. Scammers take advantage of this speed and trust, crafting texts that blend seamlessly into the flood of legitimate messages we receive every day.

Unlike spam emails, smishing often escapes detection by traditional filters and firewalls, and because it targets individuals directly, it can be harder to identify and block in advance. What makes smishing especially dangerous is how it blends the personal with the technical. A convincing smish can trick even tech-savvy users if it appears at the right time, like during a service outage or a busy holiday season, and asks just enough to trigger concern, curiosity, or compliance. Understanding smishing isn't just a matter of cybersecurity, it's a matter of digital literacy, public policy, and consumer protection.² As attackers continue to evolve their tactics with AI-generated texts, spoofed phone numbers, and fake apps, the need to educate and empower users is more urgent than ever.