Smishing
Definition
Phishing by text message: a fake SMS that tries to get you to click a link, share a code or send money.
Smishing, explained
Smishing combines SMS and phishing. Scammers send texts posing as delivery companies, toll agencies, banks or tech support, urging you to click a link, call a number or share a verification code. A common trick is to trigger a real login code to your phone and then text you pretending to need it back. Legitimate services do not ask you to forward a code by text or phone. In the US you can report spam texts by forwarding them to 7726 (SPAM), and UK and Canadian carriers support the same shortcode. Keeping your real number off low-trust sign-ups reduces how many of these you get.
Related terms
Sender ID
The name or number shown as the sender of a text message, such as a short code, a phone number or a brand name.
OTP (one-time password)
A short code that is valid for a single login or verification and expires quickly.
Passkey
A phishing-resistant sign-in credential stored on your device and unlocked with your fingerprint, face or PIN.
Where you'll meet this term
Smishing Explained: Common Text Message Scams and How to Spot Them
How to spot smishing texts: fake package delivery, unpaid toll, bank alert and refund scams in the US, UK and Canada, and how to report them.
Read the guide →SMS codes vs Authenticator appSMS codes vs authenticator apps for 2FA
Authenticator apps resist SIM swaps and interception better than SMS codes. SMS 2FA is easier to recover. How each works and when to use which.
See the comparison →SMS verification vs Email verificationSMS verification vs email verification
Email verification is free and easy to recover; SMS is harder to fake in bulk but tied to a number you must keep. How they differ and when each fits.
See the comparison →