What is smishing, and how can it be avoided?

By now, there’s a good chance you’re already familiar with “phishing.” But what is “smishing”? Like phishing, smishing is a scam that involves criminals trying to trick you into revealing personal information — with scams operating via text message rather than email.

“Smishing” is a portmanteau of “SMS phishing” or phishing that occurs through text messaging. Google Trends shows smishing has increased dramatically in the past decade. In 2022, Americans lost $330 million from smishing scams. In the UK, the number of smishing attacks grew by nearly 700% in the first six months of 2021. 

How does smishing work?

The more time you spend online, the greater your chances become of losing data to a data breach. A 2017 Pew Research study found 64% of Americans were victims of a least one data breach. That number has likely increased since then.

The end result? If you’ve ever given out your number to a business (whether online or in person) you may have already lost that number in a data breach. And if you’re getting spammed with text messages from people you don’t know, it’s likely because your number was lost in a data breach and then purchased on the dark web. 

Purchased on the dark web? Yes! 

Large swaths of data stolen consumer data get bought and stolen on dark web marketplaces, often for only a few dollars per download. From there, all a cybercriminal needs to do is set up an automated service to with a virtual number and begin spamming phone numbers with text message phishing attempts. 

A 2017 NBC Nightly News report highlights a smishing scam that tried to get victims to activate a new credit card. The messages prompted individuals to call a number and enter private information over the phone. Other smishing scams identified by the report include ones that tell users their online accounts (such as Apple ID) are expiring. Others offer promises of cash prizes from companies like Walmart if only you’ll click on the included link.

More recently, US citizens were targeted in a large-scale smishing campaign involving attackers impersonating services such as the Royal Mail and USPS. The attackers obtained personally identifying information (PII) by asking message recipients to reschedule failed deliveries using a fake form.

DONT click those links

At times, smishing may actually lead users to install a virus on their devices. In these situations, the results may actually be worse for some users. A Pew Research survey found that only 32 percent of smartphone users install antivirus software on their devices. And while the data doesn’t distinguish between iPhone and Android users, our best guess is that the majority of that 32 percent is coming from Android. Unfortunately, Mac users typically spurn antivirus, falsely believing their Apple devices are immune to threats.

Overall, what smishers are usually looking for is the missing piece of the puzzle that they couldn’t obtain from hacked data. That could be a social security number, pin number, password, or any other private detail that will help them access your accounts. It’s easy to say “just don’t give it to them,” yet many smishing scams are intricately designed to elicit a response, even if that response is just a tentative and short-lived click on a seemingly legitimate link.

How to avoid smishing scams

There are several strategies you can use to avoid becoming a smishing scam victim:

• Don’t click on links within spam texts
• Don’t respond to messages
• Research spam numbers to verify they’re spam
• If spam messages are using a legitimate business name, call that business directly with its official number to verify
• Use a VPN to reduce smishing attempts
• Use spam blocking app to automatically block smishing attempts

Let’s elaborate on how these strategies work in practice.

1. Don’t click on any links in the message

Most smishing relies on emotional manipulation. Often, scammers don’t need you to overtly give up passwords, pins, and social security numbers. At times, all they need to do is pique your interest enough to get you to click on a link and download a virus to your phone or enter your information into a website.

There’s a good chance that if you did click on a phishing link, your mobile device is already infected. Viruses are designed to stay hidden and you may not realize your phone is actually infected.

Common signs that your mobile device is infected include:

• Excessive memory usage
• Your phone consistently overheats
• Your battery drains faster (due to background operations)
• Pop-up messages while using your smartphone web browser

If you did happen to click on a link from a suspected smishing text message, your best option is to install an antivirus app and scan your device. Any virus hiding on your phone could be logging keystrokes and stealing private information, meaning the smishing scam could already have been successful. Still, it’s better to cut it off at the heels even if you’ve potentially lost valuable information up to this point.

On the other hand, installing an antivirus app can help prevent smishing attacks in the future. A good antivirus app should block any virus installation attempts in the future, as well as block potentially malicious websites.

2. Don’t reply to or call smishing numbers

Even if the spam message says “text ‘stop’ to stop receiving messages,” never send a response!

Replying to a scam number, even with a “stop” message, may result in you receiving even more messages. The same may be true if you try to call the smishing number. Scammers often don’t know whether the numbers they’re spamming are active or inactive without a response. When you provide a response, you verify that the number is active, giving the spammer renewed focus on your number.  

A more effective option is to block the number outright after you receive the spam text. Android and iOS devices allow you to block numbers from your text message app.

3. Do a web search of both the number and the message content

If you’re feeling a bit uneasy about a potential smishing scam, type the number or the message (or both) into a Google search. You probably aren’t the first person to receive that message. In many cases, you’ll find others posting on various scam number websites. Don’t just trust one negative response or inquiry, however. Look to see if a suspicious number or message has numerous others commenting that the number is potentially a scam.

For personal reference, I tend to get an overwhelming amount of spam and robocalls. My personal favorite site to research numbers is 800notes.com. When I get a call or text from a suspicious number, I rely on the site to help vet the number of potential scams or spam. If you’re in the UK, who-called.co.uk is a useful resource. 

4. If the phishing message contains a legitimate company name, call the company directly

Some smishing messages will attempt to draw you in by using a well-known company name, such as a retail store or bank. If you believe the message is a scam, instead of calling or texting the scam number, look up that company’s customer service number from its official website. Contact the service through that number and inquire about the message you received. If they confirm that it’s not from them, delete it.

5. Utilize a VPN on your mobile device

Cybercriminals can use your location to target you for smishing attacks. According to internet security company Sophos, cybercriminals are increasingly using location data to better target individuals. Cybercriminals can use that data to send you smishing messages that appear hyper-local. Personal and localized smishing attempts are more likely to yield a response from victims.

A VPN app like NordVPN could help spoof your location and hide you from localized smishing attempts. If you receive a smishing message based on your spoofed location, it’s much easier to recognize that messages from unknown numbers are scams.

6. Use a spam blocking app

Having trouble with an influx of SMS spam or phone calls to your Android or iOS device? You might have a few solutions available to you through your app store, or even through your phone’s operating system.

Related: Best spam call blockers for iPhone

Block calls and text messages on iOS

Since the introduction of iOS 7, Apple has included call and text message blocking as a software feature. To block either text messages or phone numbers, go to:

• Settings
• Phone (or Messages for texts)
• Blocked

From there, add the numbers you want to block to reject all new messages. You can also block text messages by going to your Messages, selecting the offending message, selecting “Details” under “i” from the top right of your screen, and then selecting “Block Caller”.

Keep in mind that for this to work, you’ll need to add a number to your contacts list. This is a good way to block contacts from repeated offenders, but it won’t block smishing or other phone spam attempts from unregistered numbers.

If you’re looking for more intelligent call blocking, you may want to consider RoboKiller. This app has been lauded by the Federal Trade Commission for its ability to significantly reduce the number of spam calls making it through to your phone.

RoboKiller has a number of spam numbers registered in its system but also predicts when a call is likely to be spam. Any call that comes through can be added to its blacklist. Blocked number numbers that you want to receive are whitelisted.  RoboKiller also includes an SMS filter as well to help block out unwanted smishing and other spam text messages.

See also: Phone spam statistics

Block calls and text messages on Android

Because Android phones are not unified in their architecture, you may or may not have the option to add numbers to a block list. Each device maker modifies Android in different ways, and some mobile networks, like T-Mobile or Verizon, may alter the operating systems even further.

To find out how to natively block numbers on your phone specifically, first perform a Google search. For example, you might search “how to block texts on Galaxy S20.” Such a search will bring up varying results depending on your device and Android version, so you’ll want to double-check.

If you’re not sure what device you’re using, most Android mobile phones have that information available through Settings > About phone. If you look under “Phone name” it should contain the exact phone model you’re using, defaulted as the phone’s “name” which appears when you connect to a wi-fi network. However, if you for some reason changed your phone name and can’t remember the model number, tap on “Hardware info.” You’ll find the information there as well.

As with iPhones, blocking numbers will filter out repeat spam callers and smishing attempts, but it won’t intelligently block new numbers. For that, Android users have a long list of options.

The Google Play Store is filled to the brim with SMS and call spam blockers. As with most Android apps, though, you’ll need to do a bit of personal research to decide on which app to trust. Rule of thumb: check the reviews and the app rating.

However, those two together are still not a guarantee that you’ll get a good app, especially on the Google Play Store. Fake reviews on Google Play are a bit of a problem, and there’s no easy solution either. The last thing you want to do is download a bad app, or worse, one riddled with spyware.

Based on our own analysis of app reviews and ratings, we recommend the Truecaller app. The app has more than a billion downloads, and a 4.6 out of 5 stars across over 20 million Play Store reviews. The app can intelligently block both SMS spam and phone calls. It also allows you to blacklist and whitelist numbers on the fly.

How to report spam calls and messages – US, UK, Canada, Australia

You might feel a bit helpless against spam calls and text messages, but you do have a voice. In the US, UK, Canada, and Australia, both official and unofficial options exist to help take down spammers.

US Residents

Despite the threat of prosecution from the government, spam callers and texters continue to ply their trade. The good news is that US residents have several options to reduce spam calls and smishing attempts:

1. Register spam numbers with a dedicated spam number website

A number of websites now exist where you can report and discuss spam numbers. If you receive a spam number, submit the number to a site dedicated to rooting out phone spam. We’ll recommend again the website 800notes.com. Here you can submit the number with a note about the call or text message. This will help aid others who are also receiving messages from these numbers and wondering if it’s trustworthy.

2. File a complaint

Although the National Do Not Call Registry is effectively dead, you can still file a complaint with the FTC. Note, however, that the FTC requires your number to be registered for at least 31 days before you can file a complaint. The Do Not Call Registry is primarily for spam phone calls.

You can report spam text messages directly to the FTC without registering with the DNCR. Simply forward the texts to 7726 (or “SPAM”).

Don’t expect an immediate or timely response from the FTC, however. Even if your complaint is looked into, you are unlikely to hear back from the government about any action taken. Complaints go into a database where the FTC will look for repeat offenders and investigate those numbers. Still, adding your data to their information can help root out spammers.

UK Residents

If you’re receiving scam texts and phone calls in the UK, here are a few available options for you.

1. Contact ActionFraud

ActionFraud, or the National Fraud & Cyber Crime Reporting Centre was set up to handle the on-going scam issues in the UK. If you’ve been receiving what are clearly fraud messages, you can either call the Centre (0300 123 2040) or forward the messages to 7726.

2. Register with the Telephone Preference Service – and file a complaint if you’re already registered

The Telephone Preference Service is designed to prevent or reduce unsolicited telemarketing calls to your phone. You can register your number with TPS on its website.

If you’re already registered and you’re still receiving calls, you can file a complaint through the website as well.

3. File a complaint with the Information Commissioner’s Office (ICO)

TPS suggests filing a complaint with TPS as well if you continue to receive unwanted calls. Unlike TPS, however, ICO also handles SMS spam. This is a good option if you are receiving smishing attempts on your phone. ICO handles all types of spam and fraud associated with digital communications.

4. Register the number with a reverse number website

If you know the scam number is a problem, look it up and register it with a reverse number website like who-called.co.uk. The site lets you register numbers that you know are a scam as well as look up numbers that might be suspicious. If you’re submitting a scam number on the site, you can leave a note to explain what kind of behavior or messages you were receiving to help others in the fight against spam.

Canada Residents

In Canada, phone scams are still a problem despite government efforts. Here are some options Canadians can take to fight back.

1. Use a reverse number lookup and registration site.

There are a few sites available for looking up numbers in Canada. We suggest canadianareacodes.net. The site maintains an active list of numbers registered in Canada. You can also register a number with information regarding the kind of message you received to help others discover whether a number is being used to run scams.

2. Report the scam to the Canadian Anti-Fraud Centre

The CAFC was set up to help Canadian residents identify and report all types of fraud and scams. This includes smishing attempts and nuisance phone calls. You can either call the CAFC (1-888-495-8501) or register the complaint with their online Fraud Reporting System. The CAFC online system requires you to have a GCKey to login and register your complaint. The key is free, but you’ll need to obtain your GCKey through an online portal.

Australia Residents

As with Canada, the UK, and the US, Australia has its own, increasingly troublesome phone scam problem. Here are some solutions for Australian residents who need to take action against phone spammers.

1. Enter the Do Not Call Register

Australia’s Do Not Call Register has been going strong for over a decade. In case you missed it, the government numbers submitted to the register a permanent action. This means you do not need to resubmit your number, helping solve the issue of having your number expire and those spam calls re-emerge. Government research from 2015 shows most Do Not Call Register users noticed significant reductions in unwanted calls.

2. File a complaint with the Australian Communications and Media Authority (AMCA)

The AMCA, which also runs the Do Not Call Register, allows you to lodge a complaint online if you’ve been receiving spam messages. You will need to have been registered for at least 30 days and the calls must have been received during non-standard business hours. Unfortunately, the complaints must be related to spam calls and do not count for SMS spam.

To report SMS spam to the AMCA, you’ll need to forward your spam text message to the agency directly. The number to forward SMS spam to is 0429 999 888. It’s important that you forward the number to the AMCA, as this adds to their database and helps them better identify, track, and ultimately deal with SMS spammers.

3. Register the number with a reverse number website

If you’re convinced a number sending you messages or calls is a scam, register that number online. For Australia, one of the best sites to use is reverseaustralia.com. The website allows you to register numbers with a comment regarding what type of behavior you received from that number. You can also use it to look up suspicious numbers in case you’re concerned a call or text from an unknown number could be a scam.

Even with your phone scam issues covered, you’ll still need to be on the lookout for email scams. But that’s a matter for another day.