What Is Smishing and How Does It Work?

A smishing attempt usually starts with a believable reason for making contact. A criminal may refer to a delivery, an unusual payment, an account warning, a refund, a fine or a workplace request. The context is selected to make the message feel relevant enough to act on.

Pressure then reduces the chance of an independent check. The text may claim that a deadline is close, an account is about to be restricted or a senior colleague needs something immediately. Authority, urgency and emotion are common features of scam communications because they encourage action before reflection (NCSC, 2022a).

The requested action creates the route into the fraud. A link may lead to a fake website that collects login details or financial information. A reply may begin a longer fraudulent conversation. A supplied number may move the recipient into a fraudulent phone call. A download may expose the device to malicious software.

A familiar sender name, number or message thread does not establish who sent the text. Criminals can spoof sender information so that a fraudulent message appears alongside genuine messages (Report Fraud, 2026a). The aim may be to steal information or money, gain access to an account or compromise a device.

Smishing can look like a routine delivery, banking, payment or workplace message. The four illustrative examples use no real organisations, telephone numbers or links because the scenario matters more than a particular brand or wording.

A text claims that a parcel could not be delivered and that a small redelivery charge is due. The link leads to a page asking for payment and personal details. The pretext feels routine, especially if the recipient is expecting a delivery. The unexpected fee and unverified link are reasons to leave the text and check the delivery through the courier’s official website or app.

A message claims that an unusual transaction has been detected and tells the recipient to secure the account immediately through a link or supplied number. The pressure comes from the fear of financial loss. The safe check is to open the bank’s official app or use a trusted number, such as the one printed on the bank card, rather than following the route in the message.

A text claims that a charge will increase unless payment is made today, or that an unexpected refund is waiting to be claimed. Both versions use a consequence or reward to prompt quick action. The recipient should question whether the contact was expected and verify the position through the official organisation’s published route.

A message appears to come from IT support, a colleague or a manager. It asks the employee to confirm a login, share a security code, send information or bypass the usual approval process because the matter is urgent. The sender name may look familiar, but the change to normal working practice is the stronger warning. The request should be checked through the organisation’s established contact and authorisation route.

Official UK guidance describes the same broad patterns across delivery, banking, government-body and familiar-person scams (Ofcom, 2026a). No one example proves that every similar message is fraudulent. Each one gives the recipient a reason to pause and verify.

Smishing is a phishing technique delivered through text or mobile messages. Phishing is the wider category and is often associated with email, although official guidance also uses the term for fraudulent texts and calls. The delivery channel changes, but the attacker is still trying to trigger an unsafe action by presenting a false request as genuine (GOV.UK, 2023).

You can recognise a possible smishing message by looking for unexpected context, pressure and consequential requested actions. Any of these patterns is a reason to stop and check:

• The contact, timing or context is unexpected.
• The sender creates urgency, fear, secrecy or the prospect of an unusually attractive reward.
• The request involves a password, security code, payment, bank detail, personal information or account access.
• A link or telephone number has not been obtained independently from a trusted source.
• The message changes a normal process or asks the recipient to bypass approval or verification.
• The sender name, number or message thread looks familiar but cannot independently prove who sent the text.

Spelling, grammar and formatting can support suspicion, but polished language does not make a message safe. The NCSC notes that scam communications have become harder to identify by appearance alone (NCSC, 2022a).

The practical test is the request. An unexpected message that asks for a consequential action deserves an independent check, even when the wording and sender details look credible.

You can reduce the likelihood of acting on a smishing message by using the same three-step response whenever a text makes an unexpected or consequential request.

1. Stop before acting. Do not click the link, reply, call the number, make a payment or share information while the request is uncertain. Taking a moment creates time for an independent check.
2. Verify through a trusted route. Open the organisation’s official app or type its known website address yourself. Use a number from an official website, an account statement, the back of a bank card or an existing contact record. If the text appears to come from a colleague, use contact details already held or speak to the person directly. Do not verify through the link, reply option or number in the suspicious message.
3. Report the message. Follow the organisation’s reporting process when the message concerns work, a work device, work information or work access. Before blocking or deleting the message, retain the details your organisation or provider needs, in line with that process.

Suspicious SMS texts can be forwarded free of charge to 7726. Built-in phone reporting can also be used. Rich Communication Services (RCS), iMessage and app-based messages do not all follow the same route, so use the phone or app’s reporting feature where appropriate (Ofcom, 2026b).

If you have already interacted with a suspected smishing message, end the contact and report what happened promptly. The immediate response depends on the action taken, but the employee should not be expected to diagnose the incident or investigate it alone.

The NCSC gives action-specific guidance for compromised passwords, banking details, work devices and software installation (NCSC, 2022b). Where personal data may have been exposed, the responsible organisational function should assess the incident and decide whether notification is required. The employee who received the text should report the facts rather than decide whether a legal reporting threshold has been met (ICO, 2025).

Organisations can reduce smishing risk by combining clear verification and reporting processes with appropriate technical controls, secure account access and incident response. Employee awareness supports this arrangement but is not a complete control system. The NCSC recommends a layered approach to phishing that combines people, process and technology, while planning for messages that may still get through (NCSC, 2024).

Organisations can strengthen that system by:

• giving employees a quick, clear and non-punitive route for reporting suspicious messages and mistakes
• defining trusted verification routes for payments, account changes, access requests and identity checks
• making normal processes clear enough for an unexpected request or attempted bypass to stand out
• using appropriate account security, access controls, supported devices, updates and protective technology to limit the effect of one interaction
• including realistic mobile-message scenarios in relevant awareness training
• practising incident response so that a report leads to prompt containment and support

A process that depends on every employee identifying every fraudulent message cannot provide a reliable defence. A stronger arrangement makes high-impact actions difficult to complete from an unverified text and makes it safe to report uncertainty. The same system-led principle applies across common cyber security threats and wider digital fraud in the workplace.

Training supports recognition, verification and reporting. It does not replace technical controls, clear working practices or incident response.

Smishing is phishing through text messages, and the request matters more than surface appearance. Unexpected links, payments, login requests and changes to normal process should be checked through a trusted route independent of the message. Prompt, non-blaming reporting enables the organisation or service provider to respond, including when someone has already interacted.

Organisations seeking to give employees a consistent baseline for recognising suspicious mobile requests and following an agreed verification and reporting process can use Human Focus Cyber Security Awareness Training to support that need. The online course is certified by the CPD Certification Service and covers phishing messages, including fake texts, alongside voice phishing, password security and reporting responsibilities as one part of wider organisational cyber security arrangements.