Smishing Explained: SMS Phishing for the Security+ Exam

Smishing is phishing delivered by SMS. It gets its own term on the Security+ syllabus because the channel changes the defensive picture, not because the social engineering differs.

Why SMS works for attackers

No gateway. Email passes through filtering that scans links, checks sender reputation and validates SPF, DKIM and DMARC. SMS arrives directly on the device with none of that.

Higher trust and urgency. People treat texts as more personal and more immediate than email, and read them within minutes. That compresses the time available for second thoughts, which is exactly what social engineering depends on.

Small screen. The address bar truncates, so a deceptive domain is harder to spot. Link previews are limited or absent.

Shortened links are normal. Character limits made short links routine in SMS, so a message with an opaque link raises no suspicion at all.

Personal devices. The phone is often outside corporate management, without endpoint protection or web filtering.

Sender ID spoofing. In many countries the alphanumeric sender name can be set arbitrarily, so a message can appear in the same conversation thread as genuine messages from a bank or delivery company. This is the detail most people do not know, and it defeats the instinct to trust a familiar thread.

Common pretexts

Recognising the patterns is most of the defence.

Delivery notifications — a parcel needs a small fee or an address confirmation. Effective because most people are expecting something.

Bank fraud alerts — "did you authorise this payment, reply NO", followed by a call from the "fraud team".

Account verification — an account will be suspended unless verified.

MFA code requests — a message asking the recipient to forward a code they just received. Any legitimate service will never ask for this.

Tax and government refunds, timed to tax deadlines.

The executive text — a message claiming to be from a senior manager, asking an employee to buy gift cards or approve an urgent payment. This is business email compromise moved to SMS, and it works because the recipient cannot easily verify the number.

The hybrid attack

Worth knowing because it is now common and it appears in scenarios. The text is only the opening move: it prompts the victim to call a number, and the actual attack happens on the phone with a convincing operator.

That combination — smishing into vishing — defeats controls aimed at links and attachments entirely, because there is no malicious link to scan. The only artefact is a phone number.

Defences

Phishing-resistant MFA. The strongest structural control. FIDO2 and passkeys bind the credential to the legitimate domain, so credentials captured on a fake site cannot be replayed. It also removes the SMS code that many of these attacks are trying to obtain.

Move away from SMS as a second factor. SMS codes are vulnerable to smishing, SIM swapping and interception. An authenticator app is better; a hardware key better still.

Mobile device management on devices used for work, with protection and web filtering where feasible.

Training with the specific tells: unexpected messages, urgency, a link or number you did not request, requests for codes, and sender names that do not match the number. The habit to build is to reach the organisation independently — the number on the back of the card, the app, the address you type yourself — rather than through anything the message provides.

An easy reporting route. Staff should have somewhere to forward a suspicious text, and many countries operate a national reporting shortcode for carriers.

Verification procedures for payments. No payment or gift card purchase on the basis of a message alone, regardless of who it appears to be from. This is a process control, and it is what actually stops the executive-text fraud.

The channel family

Term	Channel
Phishing	Email
Spear phishing	Email, targeted
Whaling	Email, executives
Smishing	SMS
Vishing	Voice
Quishing	QR code

What to remember

Smishing is SMS phishing. It works because SMS bypasses email gateways entirely, arrives with high trust and urgency, and displays on a small screen where deceptive links are hard to inspect — and because sender IDs can be spoofed into genuine message threads. Hybrid smishing-to-vishing attacks leave no link to scan. Phishing-resistant MFA and independent verification procedures are the controls that hold.

Related reading: Vishing · Quishing · URL shorteners and link analysis