Smishing is phishing delivered by SMS or messaging app, and it works because people trust their phones more than their inbox and read texts within minutes. Staff often use personal phones for work, so a text scam can reach business accounts without any email filter ever seeing it. This guide covers seven smishing examples, the red flags in each and how to train for them.
TL;DR
- Smishing bypasses email security, so staff awareness is the main defence.
- Seven patterns recur: parcel fees, bank alerts, toll notices, government refunds, fake boss requests, MFA codes and wrong-number openers.
- Never tap a link in an unexpected text; open the official app or type the address yourself.
- Never read an MFA code out to anyone who contacts you.
- Include text-message scenarios in training, not just email.
Why smishing deserves its own lesson
The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25 (ASD Annual Cyber Threat Report 2024-25). A growing share of scam contact arrives by text. Short messages leave little room to spot errors, links are shortened, and the sender name can be spoofed so the text appears inside a genuine thread.
Seven smishing examples
1. The parcel fee
A courier says delivery failed and asks for a small fee to reschedule. Red flags: you are not expecting a parcel, the link is not the courier's real domain and the page asks for card details.
2. The bank security alert
A text claims suspicious activity on your account and tells you to log in via a link. Red flags: banks do not ask you to log in through a texted link; the urgency is manufactured.
3. The toll or fine notice
A message says you have an unpaid toll or fine and a late fee will apply. Red flags: no reference you recognise, a threat of escalating fees and a payment link.
4. The government refund
A text claims you are owed a refund or benefit. Red flags: government agencies do not request bank details by text link.
5. The fake boss
A text from an unknown number says it is your manager, asks for gift cards or an urgent favour and says not to call. Red flags: a new number, secrecy and a request involving money.
6. The MFA code request
Someone contacts you and asks you to read out the code you just received. Red flags: that code is the key to your account. No legitimate service asks for it.
7. The wrong-number opener
A friendly text, apparently sent to the wrong person, starts a conversation that later turns to investments or links. Red flags: a stranger who is unusually keen to keep chatting.
A simple rule set for staff
- Do not tap links in unexpected texts. Open the official app or type the address.
- Never share codes. MFA codes are for you alone.
- Verify money requests by phone using a number you already have.
- Report and delete. Forward suspicious texts to IT and use the carrier's reporting option.
- Treat work and personal phones alike if they touch work accounts.
Building smishing into your programme
Smishing is a behaviour problem, so it needs repeated practice. Cyber Aware's security awareness training includes story-driven lessons on smishing followed by a quiz, and the phishing simulations library lets you rotate lure types through the year. Results feed into a per-person score in human risk reporting, so you can see who needs a follow-up.
FAQ
What is the difference between phishing and smishing? Phishing usually arrives by email; smishing arrives by SMS or messaging apps.
Can email filters stop smishing? No. Texts do not pass through email security, so staff awareness is the main control.
What should staff do if they tapped a link? Report it immediately, change the affected password and let IT check for suspicious sign-ins.
Are work phones the only risk? No. Personal phones used for email, banking apps or MFA also expose the business.
One last thing
Add one smishing lesson to your next training month. The scenario is short and familiar, and staff recognise it straight away.