Most businesses have spent years training employees to be suspicious of email. Things like:
- Do not click strange links
- Check the sender
- Watch for fake Microsoft 365 notifications
- Report suspicious messages
- Think before opening attachments
That is all good advice, but the problem is that cybercriminals have figured out something fairly obvious which is the scary part. They in essense have decided that if businesses are getting better at protecting email, why keep attacking email?
So they found another way in, and that other way is:
Just send a text message instead.
That is what smishing is, a phishing message delivered through SMS or another text messaging platform, and instead of a suspicious email arriving in Outlook, an employee receives a text that looks like it came from Microsoft, a bank, a delivery company, or even their own IT department.
Something like:
Your corporate password expires today. Tap here to reset your password.
It looks routine. The employee taps the link, enters their username and password, completes an MFA request, and goes back to work, and its on a phone screen where it is harder to detect issues or get good oversight on what is happening. There are no attachment to download. Nothing triggered antivirus. The email security system never saw the message because there was never an email. But the attacker now has exactly what they wanted.
What Is Smishing?
Smishing stands for SMS phishing, a form of social engineering where attackers use text messages to convince someone to click a malicious link, provide login credentials, install malicious software, send money, or disclose sensitive information.
The attack itself is not particularly sophisticated, but the psychology behind it very much is. And cybercriminals know that people behave differently on their phones than they do when sitting in front of a computer.
- We glance at a message
- We recognize a company name
- We see something urgent
- We tap
That entire process can happen in seconds, sometimes millisenconds. And unlike corporate email, text messages often exist completely outside the security controls your organization has spent years putting in place.
Why Has Smishing Become Such a Problem
Its a big IT problem because most businesses have invested heavily in email security. There are spam filters, advanced threat protection, domain authentication, link scanning, attachment scanning, endpoint security, DNS filtering, security awareness training, and dozens of other controls trying to stop a malicious email before an employee ever sees it.
SMS usually has none of that.
A text message can land directly on an employee's personal phone without ever touching the company network. That creates a very attractive path for attackers. Your email security can be excellent and well protected, your Microsoft 365 environment can be properly configured and even your computer can be monitored by IT, however somebody can still receive a convincing text message pretending to be your IT department.
A Smishing Attack Can Look Completely Normal
One of the reasons smishing works is because the messages usually imitate things people already receive like:
- A package delivery notification
- A bank alert
- A password expiration notice
- A Microsoft account verification request
- A message about unusual activity
- A request to confirm a login
None of these sound unusual on their own, we use them every day.
Attackers commonly impersonate organizations such as:
- Microsoft
- Apple
- USPS
- FedEx
- UPS
- Banks and Credit Unions
- Government Agencies
- Internal IT Departments
The message normally introduces urgency like
- Your package is being held
- Your account will be suspended
- Someone attempted to log in
- Your password expires today
- A payment failed
- You need to verify your identity
That urgency is very intentional, and the attacker does not want you investigating the message, they want you reacting to it.
The Link Is Where the Real Attack Begins
The text message is usually just the delivery mechanism and then the real attack happens after someone taps the link. A victim may be taken to a website designed to look almost identical to Microsoft 365, Google Workspace, a bank, a shipping company, or another legitimate service, and as I previously stated, on a phone screen, spotting the difference can be surprisingly difficult.
The website asks for a username and then a password and sometimes it even asks for an MFA code. To the employee, it looks like they are simply logging into Microsoft 365, but to the attacker, the employee is voluntarily handing over the keys. This happens in seconds. More advanced attacks can even use technology that sits between the victim and the legitimate website. This allows an attacker to capture credentials and authentication information in real time. That matters because it exposes an uncomfortable truth about cybersecurity:
MFA is extremely important, but MFA does not magically make phishing disappear.
- The type of MFA matters
- How the authentication request is handled matters
- Whether the employee understands what they are approving matters
Smishing Can Bypass Your Email Security Completely
This is the part businesses need to understand and really take to heart. A company can have excellent email security and still be vulnerable to smishing.
- Your spam filter cannot inspect a text message sent directly to an employee's personal phone
- Your email security gateway cannot quarantine it
- Your Microsoft 365 security tools may never see it
- Your email administrator may have absolutely no idea the attack happened
By the time your cybersecurity tools detect something unusual, the attacker may already be attempting to use the stolen credentials. That makes identity security, endpoint protection, monitoring, and employee awareness incredibly important. Security has to assume that occasionally someone will click something they should not. Because eventually someone will, we're all human and we all make mistakes.
Mobile Phones Change How People Evaluate Risk
There is also a simple usability problem.
It is easier to investigate suspicious information on a computer instead of your small phone screen.
On a desktop browser you can inspect a domain more easily. You can hover over links. You can open another tab. You can check the sender.
But phones encourage speed, screens are smaller and URLs may be shortened or partially hidden due to there being limited space. Also, people are often reading texts while walking, driving between locations, standing in line, sitting in meetings, or doing three other things at once. That is exactly the environment social engineering thrives in. Attackers do not necessarily need to defeat your technology.
Sometimes they just need to catch someone at the right moment.
Personal Phones Can Create a Business Security Problem
Bring Your Own Device environments make the issue even more complicated.
An employee's personal phone may contain:
- Corporate email
- Microsoft Teams
- Authentication applications
- Password managers
- Banking applications
- Personal email
- Cloud storage
- Business contacts
- Text messages
- Access to company applications
That phone is effectively sitting at the intersection of someone's personal and professional life.
A successful smishing attack can potentially use that intersection to move from a personal communication channel into a corporate environment. That is why businesses cannot simply say, "It happened on their personal phone, so it is not our problem." But...once corporate credentials are involved, it absolutely becomes your problem.
How to Recognize a Smishing Message
There is no perfect visual test for identifying smishing. Good attackers are specifically trying to make malicious messages look normal. There are, however, patterns employees should recognize.
Unexpected Urgency
Messages that demand immediate action deserve additional scrutiny.
Examples include:
- Your account will be locked today
- Unusual activity was detected
- Your password has expired
- Your package cannot be delivered
- Payment is required immediately
Urgency is one of the oldest tools in social engineering because urgency reduces thinking.
Requests for Passwords or MFA Codes
Your IT department should not be texting employees asking for passwords. Neither should Microsoft. Neither should your bank. Authentication codes should also be treated as sensitive information. If somebody asks you to send them an MFA code, something is very wrong.
Strange or Unexpected Links
Look carefully at the destination.
Attackers frequently register domains that resemble legitimate companies.
Microsoft may become something that contains words such as Microsoft Login, Microsoft Verify, Office Security, or Account Protection.
The presence of a familiar company name does not mean the website belongs to that company.
Messages That Do Not Match What You Are Doing
A delivery notification for something you never ordered should raise questions.
So should a password reset you never requested.
Or a bank notification from a bank you do not use.
Context matters.
Messages That Push You Away From Normal Processes
If your company normally handles password resets through a portal, an unexpected text telling you to use a completely different website should immediately raise suspicion.
Employees should know how legitimate IT communication normally happens inside their organization.
That makes impersonation much harder.
Do Not Verify a Suspicious Message Using the Message
This is one of the simplest habits businesses can teach.
If you receive a text claiming there is a problem with your Microsoft account, do not use the link in the text to investigate it.
Open Microsoft 365 normally.
If the message claims your bank account has an issue, open the bank's official application.
If somebody claims to be from your IT department, contact your IT department using the normal helpdesk process.
In cybersecurity this is called out of band verification.
In regular English, it means:
Do not ask the suspicious message whether the suspicious message is legitimate.
Use another trusted method.
What Should You Do If Someone Clicks a Smishing Link?
First, do not hide it.
This is important.
Security incidents become significantly harder to contain when employees wait several hours because they are embarrassed that they clicked something.
If an employee thinks they entered credentials into a suspicious website, IT should know immediately.
The response may include:
- Resetting the affected password
- Revoking active login sessions
- Reviewing recent authentication activity
- Reviewing MFA activity
- Checking for suspicious access to Microsoft 365 or other cloud services
- Checking whether additional employees received the same message
- Examining the affected device if necessary
- Monitoring for additional suspicious activity
If credentials were entered, changing the password alone may not always be enough. Existing sessions and authentication tokens may also need to be reviewed or revoked. That is why speed matters.
MFA Still Matters, But Use Strong MFA
None of this means MFA is ineffective, actually quite the opposite. MFA remains one of the most important security controls a business can deploy. But all MFA methods are not equal. SMS verification codes are weaker because the text messaging system itself can be attacked through techniques such as SIM swapping and interception.
Modern authentication methods provide stronger protection.
Businesses should increasingly look toward phishing resistant authentication technologies* such as passkeys, FIDO2, WebAuthn, hardware security keys, and properly configured authentication applications. Microsoft 365 environments should also use technologies such as Conditional Access where appropriate to evaluate more than just whether the user knew a password.
- Where is the login coming from?
- What device is being used?
- Does the activity match normal behavior?
- Should that user be accessing the account from that location?
Cybersecurity works best when several controls are asking questions at the same time.
Employee Training Needs to Include Text Messages
Many companies conduct annual cybersecurity awareness training. They teach employees about email phishing. Then everyone checks the box and moves on. That is no longer enough.
Cybersecurity awareness needs to reflect how people actually communicate. That means discussing:
- Email phishing
- Smishing
- Voice phishing
- QR code attacks
- Fake websites
- MFA fatigue attacks
- Social engineering
Employees do not need to become cybersecurity engineers, but they do need to recognize when something feels wrong and know what to do next.
That distinction matter because the objective of security awareness training should not be creating paranoid employees who distrust every message they receive. The objective is creating employees who know when to verify before acting.
Businesses Also Need Clear Communication Rules
To set the record straight, I will say technology alone will not solve smishing.
Organizations should clearly define how IT communicates with employees, and where that comes from. For example:
- Will IT ever ask for a password?
- Will IT ever ask for an MFA code?
- Does IT send password expiration notifications through SMS?
- Where should employees report suspicious messages?
- How should someone verify that an IT request is legitimate?
Employees should not or never have to guess. The easier your legitimate processes are to understand, the easier it becomes to recognize something that does not belong.
Cybersecurity Is Moving Beyond the Inbox
Smishing is part of a larger change happening in cybersecurity. Attackers are moving wherever users are easiest to reach.
Email, Text messaging, Microsoft Teams, Social media, QR codes, Phone calls, Fake websites and so on.
The attack channel changes, but the objective usually does not.
Attackers want credentials, access, money, or information, and that means businesses need to stop thinking about cybersecurity as a collection of isolated products.
- Email security protects email
- Endpoint security protects endpoints
- MFA protects authentication
- DNS security protects web access
- Security awareness helps protect users
- Monitoring helps detect when something still gets through
But the real protection comes from how those layers work together. Because there is no security product called "employees will never click anything." Someone should probably invent that! But until then, we have to assume mistakes will happen.
The Bottom Line
Smishing works because text messages feel personal, immediate, and familiar.
That is exactly what makes them dangerous and businesses have spent years strengthening email security, and cybercriminals are simply looking for another door. SMS gives them a communication channel that often sits outside traditional corporate security controls and leads directly to the same employees those controls are supposed to protect.
The solution is not telling employees to stop using text messages, it is building security around the reality of how people work today.
Train employees to recognize suspicious messages. Establish clear communication rules. Use stronger authentication. Monitor identity and endpoint activity. Give employees an easy way to report something suspicious. Most importantly, make sure everyone understands that clicking something accidentally is not the real failure.
Waiting to tell anyone about it is.
A text message may only be a few words long.
Unfortunately, that is sometimes all an attacker needs.
Stay safe.
