Smishing

Why attackers use SMS

Text messages carry less context than email. There is no sender domain to inspect, links are usually shortened or truncated, and the screen is small, so a lookalike hostname is harder to read. People also treat texts as more personal and reply to them faster. Together these make a text a cheap and effective lure.

The message itself is rarely the useful evidence. The phishing page it points to is: it has a hostname, a registration, DNS records and a certificate, and those are what a takedown request is built on.

Typical lures

The themes repeat across countries and brands.

• A parcel that could not be delivered and needs a small redelivery fee.
• A bank or payment app account that has been locked, or a payment that needs confirming.
• A toll, tax or fine that must be paid today.
• A lost device that has been located, with a link to a fake device-tracking login.

What to look for on the destination

Smishing pages often sit on newly registered domains, sometimes with the brand name placed in a subdomain so the visible part of the address looks right. The page typically asks for a card number or a full set of login details on the first screen. Comparing the hostname with the brand's real domains, and checking how recently the domain was registered, settles most cases quickly.

Response

Preserve the message and the URL, resolve the hostname, capture the page and its certificate, and report the hosting and registration to the responsible providers. Warn customers through channels you control, and give them one clear rule: the real service never asks for a full card number or password by text.

Related terms

• Phishing
• Lookalike domain
• Fake app / impersonation app
• Domain monitoring