Smishing is phishing delivered by SMS text message instead of email: a text that impersonates your bank, a parcel courier, a toll road or a government agency, built to make you click a link or hand over details. It matters in 2026 because it walks straight past the email filters every business invests in — a text message on a personal phone is not scanned, logged or reported anywhere by default. Australia's National Anti-Scam Centre tracks the current variants on Scamwatch, and the pattern behind nearly all of them is the same: urgency plus a link.
TL;DR
- Smishing is SMS phishing — the same tricks as email phishing, delivered by text message.
- It bypasses email security entirely: personal phones have no report button, no filter and no logging.
- The dominant Australian lures are parcel delivery fees, toll-road notices, myGov impersonation and bank alerts.
- The check is the same as for email: sender, link destination, context — and texts you never asked for default to suspicious.
- Roughly 60% of breaches involve a human element (Verizon 2025 DBIR); smishing trains the same reflex email phishing does.
What is smishing?
The word is a blend of SMS and phishing. The attacker sends a text that reads like an ordinary notification — your parcel is held, your toll account is suspended, unusual activity on your account — with a link to a page that collects card details, login credentials or one-time codes.
Three things make smishing dangerous for businesses even though it lands on personal phones:
- The boundaries are blurry. Staff check work messages and personal texts on the same screen, and a compromised personal account often leads to a work one.
- There is no filter. A text that would be flagged in a corporate mailbox sits unread in a phone's message list with nothing to warn the reader.
- The link tricks are getting better. Shortened and lookalike links, MFA approval prompts and QR codes now carry the same credential-harvesting loads as email phishing.
The smishing lures Australians receive most
| Lure | What the text says | The tell |
|---|---|---|
| Parcel delivery | Your package is held — pay a small fee to release it | You did not order a package needing a fee; real couriers rarely SMS payment links |
| Toll road notice | Your toll account is overdue — pay now to avoid fines | No toll road you actually drove; state toll operators do not demand payment by SMS link |
| myGov / Centrelink | Your Medicare or Centrelink details need updating | myGov never sends sign-in links by text or email |
| Bank alert | Unusual activity — verify your account now | Banks do not text links asking you to log in; open the app yourself instead |
| Missed call / voicemail | Tap to hear a voicemail from an unknown number | The link loads a credential page, not a voicemail |
Why smishing works
The same number that explains bulk phishing explains smishing: recognition is a reflex, and reflexes are built by short, frequent practice. KnowBe4's 2026 Phishing by Industry Benchmarking Report puts untrained phishing susceptibility at 33.2% — one in three staff clicks a malicious message — falling to 4.2% after twelve months of sustained monthly training and simulation. A text message is simply that test moved to the channel with the least protection.
The Australian backdrop is heavy: the ASD logged more than 84,700 cybercrime reports in FY2024-25, one every six minutes. Smishing is the entry point for many of them — the small fee that captures a card, the toll notice that captures a login, the bank text that captures an MFA code.
How to spot a smishing text: the six-second check
- Sender. Did you expect this number to text you? A generic sender ID or a long unfamiliar number is a flag.
- Link. Do not tap. Press and hold to preview the destination — a lookalike domain or link-shortener ends the question.
- Context. Were you expecting a parcel, a toll charge or an account issue? If the message arrived out of nowhere, it defaults to suspicious.
- The ask. Any text asking for payment, login, MFA code or personal details is treated as fraud until verified through the organisation's own app or website — navigated to directly, never through the link.
Staff who train on email phishing simulations transfer the habit: the sender-link-context check is identical on both channels. Cyber Aware's security awareness training covers non-email channels in the monthly modules, because a curriculum that only teaches email leaves the phone defenceless.
What to do when a smishing text arrives
- Do not click, reply or call any number in the message.
- If it impersonates a real organisation, report it on Scamwatch so the pattern is logged.
- If you already clicked or entered details, change the affected passwords immediately, contact your bank and report cybercrime to ReportCyber.
- Tell your team. One real smishing text shared internally teaches more than a slide deck.
Is smishing the same as phishing?
Smishing is phishing by SMS — same goal (credentials, money, data), same pressure tactics, different channel. Vishing is the voice-call version, and QR-code phishing (quishing) moves the same lure into printed and posted codes.
Can smishing steal MFA codes?
Yes — and it is the reason MFA discipline matters as much as link discipline. An attacker with your password texts a fake prompt or calls pretending to be IT to collect the one-time code. Staff should know: an unexpected approval prompt is denied and reported, and a one-time code is never shared with anyone, including callers claiming to be IT.
FAQ
What is smishing? Phishing delivered by SMS: a text impersonating a bank, courier, toll operator or government agency, designed to make you click a link or hand over details.
Why does smishing bypass email filters? Because it never touches email. The message lands on a personal phone with no corporate filtering, logging or reporting attached to it.
What are the most common smishing texts in Australia? Parcel delivery fees, toll-road overdue notices, myGov and Centrelink impersonation, and bank account-verification texts — all catalogued on Scamwatch.
Will myGov text me a sign-in link? No. myGov never sends sign-in links by text or email; any message that does is impersonation.
How do I check if a text is a scam? Do not tap the link. Press and hold to preview the destination, check whether you expected the sender at all, and verify any claim through the organisation's own app or website.
Does staff training help against smishing? Yes. The recognition reflex trained on email phishing transfers directly — the sender-link-context check is the same on a phone screen.
One last thing
Add texts to your incident-reporting habit, not just emails. The staff member who forwards a suspicious parcel text to the team in the group chat is doing exactly what your awareness programme exists to build — and the courier-lure text that hit them will hit someone else in your business within the week.