Smishing (SMS Phishing)

Layer 8: People Medium risk

How it works

Smishing is phishing delivered by text message. Messages commonly pretend to be from Canada Post or a courier about a missed package, a bank about a locked account, a toll or parking authority about an unpaid fee, or a government program offering a refund. Short links hide the real destination, and the small phone screen makes fake websites harder to spot.

Many people trust texts more than email and read them immediately, which makes this approach effective. Work accounts are at risk because staff often sign in to Microsoft 365, banking or payroll systems on their phones. A captured password or card number can be used within minutes, and some messages try to persuade people to install apps that can monitor the device.

Warning signs

• Unexpected texts about packages, refunds, fines or locked accounts
• Shortened or misspelled links
• Messages from unknown numbers or email-to-text addresses
• Requests to reply with codes or personal details
• Prompts to install an app outside the official app store

How to defend against it

• Do not tap links in unexpected texts; open the official app or site instead
• Manage company phones with mobile device management
• Use MFA methods that resist phishing, such as passkeys
• Include mobile scams in awareness training
• Forward spam texts to 7726 to report them to your carrier

If it happens to you

1. Do not respond further to the sender
2. Change any passwords entered and notify IT
3. Call your bank if payment details were shared
4. Remove any app installed from the message