Smishing is phishing by text message: a scam SMS that impersonates a trusted organisation — a courier, your bank, the ATO, a toll road — and pushes you to a fake link or a conversation that ends in stolen money or credentials. The name blends SMS with phishing, and the pattern is identical to email phishing: a trusted name, manufactured urgency, and one tap before you think.
TL;DR
- Smishing is SMS phishing — the same social-engineering tricks as email phishing, delivered to a phone.
- Text scams work because phones strip context: no sender domain to inspect, no spam folder, and the message sits next to real texts from your bank.
- Voice and SMS breach vectors averaged USD 5.29 million per breach in IBM's 2026 Cost of a Data Breach Report — among the most expensive breach types measured.
- The defence is behavioural: pause, check the sender, never tap links in unexpected texts, and report to Scamwatch.
What is smishing?
Smishing (SMS phishing) is a social-engineering attack delivered by text message. The scammer pretends to be an organisation you deal with and asks you to act: tap a link, approve a payment, reply with a code. Because the message arrives on your phone — where real messages from banks and services actually land — it borrows trust the attacker never earned.
It is one of three channel variants of the same attack:
| Channel | Name | Typical lure |
|---|---|---|
| Phishing | Fake invoices, document shares, login alerts | |
| SMS | Smishing | Parcel delivery fees, toll road balances, bank account holds |
| Voice call | Vishing | Fake IT support, bank fraud teams, executive requests |
How a smishing attack actually works
- The setup. The attacker sends thousands of texts impersonating a familiar brand. Australian examples that recycle constantly: AusPost parcel redelivery, toll road accounts, Medicare and myGov notices, bank card suspensions.
- The hook. The message carries urgency and a small obstacle — a package held because of an unpaid fee, an account suspended pending verification.
- The capture. The link opens a clone of a real site that takes card details, logins or one-time passcodes. Some scams skip the link entirely and simply reply, building a conversation that ends in a payment or a code.
- The cash-out. Stolen card details are spent, credentials are reused on the real site, or a one-time code is used to authorise a transfer from the victim's own accounts.
The whole exchange can take under two minutes, which is why it works on a busy Tuesday afternoon far better than a long-form email scam ever did.
Why smishing catches careful people
Email training taught people to check the sender's domain — but a text message has no domain to inspect. The attacker can appear as a name like 'AUSPOST' or 'Bank' through sender ID spoofing, and the message lands inside the same thread view as genuine service texts. There is also no spam filter for SMS on most phones: everything delivered stays delivered.
The psychology does the rest. Scamwatch, the ACCC's scam-reporting service, warns Australians constantly about text scams impersonating delivery services and toll roads precisely because the pattern repeats: small amounts, high volume, low scrutiny. Nobody carefully audits a $2.99 'redelivery fee'.
What smishing costs
IBM's 2026 Cost of a Data Breach Report ranked phishing as the most common initial attack vector for the fourth year running, with voice and SMS vectors among the most expensive breach types at an average of USD 5.29 million per breach — more than many purely technical intrusion paths. The per-message cost of a text scam is trivial; the cost of one compromised business account is not.
For a business, the risk concentrates in three places: staff who process payments on phones, the company's own phone number being impersonated to customers, and one-time passcodes requested from suppliers. The human element remains the entry point in roughly 62% of breaches (Verizon's 2026 Data Breach Investigations Report) — and a text message is the most direct route to a human that exists.
How to spot a smishing text
- An unexpected link. Banks, couriers and government services do not send texts asking you to fix a problem by tapping a link. Treat every unsolicited link as hostile until proven otherwise.
- A payment request. Any text that wants a fee, a fine or a balance topped up is a scam until verified through the organisation's real app or website.
- A code you did not request. If a one-time passcode arrives unprompted, someone is mid-attack on one of your accounts. Do not share it, and change that account's password.
- Urgency plus authority. 'Account will be closed in 24 hours.' Real deadlines do not arrive by SMS from institutions that have your email, your app and your statement.
- Reply-to shortcuts. 'Reply YES to confirm' is data collection, not verification.
What to do instead of tapping
Open the organisation's app or type its web address yourself — never the link from the text. If the message claims to be your bank, call the number on the back of your card. If it claims to be a courier, check the tracking number in your original order confirmation. The genuine channel always exists; the scam depends on you not using it.
If you have already tapped: move fast — call your bank, change the affected passwords, and report the scam to Scamwatch, which feeds national scam-blocking and takedown work.
Where training fits
Smishing is a human-layer attack, so it belongs in human-layer defences. Good security awareness training covers the same psychology across every channel — email, SMS and voice — in short monthly lessons rather than one annual course, because the scams rotate faster than an annual refresher can track. Pairing the lessons with realistic phishing simulations gives staff safe practice at the recognition reflex, and human risk reporting shows which roles keep getting caught so the next lesson lands on the right desks.
FAQ
What is smishing in simple terms? A scam text message pretending to be someone you trust — a bank, a courier, a government agency — designed to make you tap a link or hand over details. It is phishing by SMS.
How is smishing different from phishing? The channel. Phishing arrives by email and usually carries a fake link or attachment; smishing arrives by text and leans on urgency with less context to check. The psychology and the goal are the same.
Can my phone's spam filter stop smishing? Partly. Modern phones flag many scam texts, but spoofed sender IDs and constant new numbers keep getting through. The filter is a seatbelt, not a driver.
What should a business do about smishing? Train staff on the pattern (unexpected link, fee request, unrequested code), set a rule that payment requests are verified through a known channel, and rehearse it with simulations. Payment-process staff on phones need it most.
Should I report smishing texts? Yes — report them to Scamwatch. Reports feed the National Anti-Scam Centre's data and help telcos block campaigns faster.
One last thing
The most valuable three seconds in smishing defence are the pause between reading the text and tapping the link. Training exists to install that pause — everything else is the scammer's design working as intended.