Smishing

SMS has no end-to-end sender authentication comparable to email's SPF, DKIM and DMARC. Application-to-person traffic enters mobile networks through aggregators and SMS gateways, and the originator field can be a phone number or an alphanumeric sender ID of up to 11 characters, such as a bank or parcel-carrier name, which the recipient's handset displays as given. Because phones group messages by sender, a spoofed sender ID can land inside the same conversation thread as genuine messages from that organisation, which is one of the most persuasive features of the attack. Some countries run sender-ID protection registries in which brands register their names and operators block unregistered use, but coverage depends on each operator and on traffic entering through international routes.

Delivery infrastructure varies. Criminals rent bulk-SMS accounts, run SIM farms that rotate through prepaid SIM cards, and in several countries police have seized so-called SMS blasters: portable fake base stations that force nearby phones onto 2G and push messages directly to them, bypassing the operator's filtering entirely. Over-the-top channels such as iMessage, RCS and WhatsApp are increasingly used because they are end-to-end encrypted and therefore invisible to operator-level SMS firewalls; large Chinese-speaking phishing-kit operations have run such campaigns with fake toll, parcel and tax lures since at least 2023.

The landing side is engineered for mobile. Links use URL shorteners, newly registered lookalike domains or free hosting, and kits cloak themselves by serving the phishing page only to mobile user agents from the targeted country, showing a harmless page to scanners and desktop browsers. Mobile browsers truncate the address bar, so the full domain is rarely visible. Payloads are credential and card harvesting, often with a real-time operator relaying one-time codes, or malware: FluBot, spread in 2021 through fake parcel-delivery texts across Europe, tricked Android users into sideloading an app that stole banking credentials and texted itself onward from the victim's contacts.

For organisations, the main problem is that the attack arrives outside the email security stack. Mitigations are mobile device management with mobile threat defence and DNS or web filtering on work phones, phishing-resistant MFA so harvested credentials and codes are useless, clear internal rules that IT, HR and payroll never ask for logins by text, and a reporting path that works from a phone. Smishing is phishing by channel; spear-style smishing that uses the target's name and role differs from vishing mainly in that the pressure is written and asynchronous rather than live, and the two are often combined, with a text asking the victim to call a number where a vishing operator takes over.