What is smishing? Steps to protect yourself and your employees

The next time you receive an unsolicited text message, pause before opening it. Smishing combines short message service (SMS) and phishing and is performed via text or social media messaging. Depending on the cybercriminal’s focus and expertise, a smishing attack can trick an individual into entering their login credentials to a fake website, installing an app laden with malware or simply responding to a text and providing their username and password.

In more sophisticated smishing schemes involving financial institutions, cybercriminals will attempt to log into a financial institution’s website using stolen credentials. They know that this login attempt will cause the site to send a one-time password (OTP) to the legitimate user, which is a security protocol known as multi-factor authentication (MFA).

To circumvent MFA, which requires users to submit the OTP during the login process, an attacker will pose as the bank or financial institution, contact the individual who received the OTP via text or phone and ask them to share the OTP. Having gathered the OTP from the actual customer, the criminal uses it to access the individual’s account.

Using their access, criminals will steal funds in the account using the quickest means available, including wires, ACHs, and Peer-to-Peer (P2P) transactions. The criminals will often transfer the money to overseas accounts, making it almost impossible to recover the funds.

How big of a problem is smishing?

Smishing has become one of the most prevalent cyber threats facing consumers and organizations. According to the FBI’s Internet Crime Complaint Center (IC3) 2025 Annual Report, phishing/spoofing (which includes smishing) was the most reported cybercrime category, with 191,561 complaints and over $215 million in reported losses. Overall, the IC3 received more than 1 million complaints in 2025, with total losses exceeding $20.8 billion — a 26% increase from 2024.¹

The Federal Trade Commission (FTC) reports that text messages were the top contact method cited in fraud reports in 2025, with over 411,000 reports referencing text messages and median losses of $1,000 per victim. In 2024, consumers reported $470 million in losses to text scams — more than five times the amount reported in 2020. Fake package-delivery messages, bogus bank fraud alerts and unpaid toll notices ranked among the most commonly reported text scams.²

Notwithstanding the financial losses, a successful smishing attack can expose an individual’s personally identifiable information, resulting in the stress and inconvenience of identity theft. The FBI IC3 recorded 31,675 identity theft complaints in 2025.³

How AI is making smishing easier — and more dangerous

Artificial intelligence has transformed the smishing landscape, making attacks easier to create, personalize and scale. Attackers can use AI to quickly generate polished, convincing text messages that mimic trusted organizations, banks or familiar services. AI also enables attackers to produce thousands of message variations, making it more difficult for both users and security filters to detect and block malicious messages.

The threat is no longer theoretical. In May 2025, the FBI warned that malicious actors were using AI-generated voice messages (vishing) alongside smishing to impersonate senior U.S. officials, targeting current and former government officials and their contacts. The advisory noted that attackers are “more frequently exploiting AI-generated audio to impersonate well-known, public figures or personal relations to increase the believability of their schemes.”⁴

The threat facing an increasingly mobile workforce

As mobile device usage has surged, so has the smishing threat. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) points out that today’s phones combine texting, calling, email and web browsing in a single device — so a single tap on a malicious link can silently launch a browser, dial a number or open an application. That convergence, CISA warns, makes it easier for scammers to trick people into taking harmful actions without realizing it.⁵

For employees who work remotely or in hybrid arrangements, the lines between personal and business devices often blur. When employees switch between personal and company-issued devices interchangeably, smishing becomes particularly valuable for cybercriminals because a single successful attack can unlock both personal and business-related data.

An attack that succeeds via a company-issued device can expose a business’s finances, networks and reputation to significant damage. A smishing attack delivered via a personal device can expose an individual’s data to an attacker, leading to one or more types of fraud.

Smishing will continue to evolve

To avoid detection and maximize their returns, cybercriminals continually refine their tactics. Instead of texting from distant area codes, some attackers spoof their phone numbers, which involves using technology to replace the area code of their device with the intended victim’s area code. They might also spoof the number of a well-known business, medical facility or government agency located near their intended victim to appear legitimate and convince the recipient to engage with the message.

As AI tools become more accessible, attackers can also generate contextually personalized messages that reference a recipient’s location, recent transactions or known contacts — making spoofed messages far harder to distinguish from legitimate communications

Protect yourself and your employees

Anyone who uses a smartphone or exchanges messages via social media must be aware of the threat and take steps to protect themselves. Here are steps employees can take to protect themselves.

1. Resist the temptation to act. Smishing attacks urge individuals to act quickly before they can scrutinize the message and question its legitimacy. Before opening a text and interacting with it, an employee should pause and give themselves time to think. They should be especially wary of texts that mention security, limited offers or legal issues, as they are often used to trigger action.
2. Businesses will not use texting to exchange sensitive data. While texting is a routine activity, for security and compliance reasons, financial institutions do not use it to gather sensitive data. If in doubt, employees should delete the message and contact their financial institution. If the message is legitimate and urgent, most institutions will follow up via other communication channels.
3. Do not store sensitive data on your device. While many smartphones remain in an individual’s possession, such proximity provides a false sense of security. Sophisticated cybercriminals can use smishing to access the data stored on any device. Employees should exercise caution when storing personal data on their phones. For example, they should not store complete passwords, bank account numbers, social security numbers or any other sensitive data they wouldn’t want anyone to access.
4. Ensure mobile devices operating system and security apps are updated. 
5. Watch for shortened URLs that tend to hide fake destination links.
6. Contact companies using an official phone number, not the text’s contact information to verify if the text is a scam. 

The magnitude of the losses associated with a smishing attack depends on the attacker’s skills and ability to use the data they steal. The more creative the attacker, the greater the potential for losses. While some employees may struggle to delete a text message without opening it, that is often the safest way to act.