Smishing is phishing delivered by text message. It is the fastest-growing form of phishing, it is harder to filter than email, and it exploits a channel where people trust what they receive.
In early 2024, the FBI began receiving complaints about text messages claiming the recipient owed unpaid road tolls. The messages appeared to come from state toll agencies like E-ZPass and SunPass, included a link to pay the balance, and warned of additional fees if ignored. By the end of the year, the FBI’s Internet Crime Complaint Center had logged 59,271 complaints tied to this single campaign. Palo Alto Networks traced the infrastructure to more than 10,000 registered domains linked to Chinese cybercriminal groups.
The toll road campaign was not sophisticated in its social engineering. It worked because it arrived by text message. Most people treat texts differently than email. They read them faster, trust them more instinctively, and have fewer tools to evaluate whether the sender is legitimate. That asymmetry between channel trust and channel security is what makes smishing effective, and why it is growing faster than any other form of phishing.
Why smishing is growing faster than email phishing
The numbers are stark. The FTC reported that Americans lost $470 million to scams that started with text messages in 2024, a fivefold increase from 2020. Smishing now accounts for roughly 35% of all phishing attacks and grew 40% year-over-year through 2025. Proofpoint found that 75% of organizations experienced a smishing attack in 2023.
The growth reflects a structural advantage text messages have over email as an attack channel. Email has decades of filtering infrastructure: spam filters, DMARC, DKIM, domain reputation scoring, and sandbox analysis all sit between a phishing email and the recipient’s inbox. Text messages bypass nearly all of it. SMS messages are delivered through carrier networks that were built for reliability, not security, and mobile operating systems display them with minimal context. There is no “from” domain to evaluate, no header to inspect, no spam folder to catch what looks suspicious.
The click-through rate tells the rest of the story. Keepnet’s research found that smishing click-through rates range from 19% to 36%, compared to 2% to 4% for email phishing. People click on malicious text messages at roughly ten times the rate they click on malicious emails.
How attackers use smishing for brand impersonation
The toll road campaign is one pattern. The broader category is brand impersonation by text: messages that appear to come from a bank, a retailer, a delivery service, or a government agency the recipient already trusts.
The FDIC has identified bank impersonation as the most common form of text message scam. A typical message warns the recipient of suspicious activity on their account, an expiring password, or a locked card, and provides a link to “verify” or “secure” their account. The link leads to a page that replicates the bank’s login screen and harvests credentials.
What makes this particularly effective is that many banks and credit unions actually do communicate with customers by text. Fraud alerts, transaction confirmations, and two-factor authentication codes all arrive by SMS. Customers are trained to expect legitimate messages from their financial institution, which means the social engineering required to make a fraudulent one convincing is minimal. The attacker does not need to persuade the recipient to do something unusual. They need to mimic something the recipient already does.
Retail brands face the same dynamic. Shipping notifications, order confirmations, and promotional offers all arrive by text, creating a pattern that attackers replicate with fraudulent messages directing customers to fake storefronts or credential-harvesting pages. The line between smishing and broader brand impersonation is often invisible to the victim: the message arrives in the same channel as legitimate brand communications, using the same tone and formatting.
Why SMS filtering cannot stop smishing
Commercial anti-smishing tools block between 25% and 35% of threats, according to aggregated 2025 research compiled by Keepnet. That means two-thirds to three-quarters of smishing messages reach their intended recipients despite active filtering.
The gap exists because the defenses that work for email do not translate to SMS. Email filtering relies on sender reputation, domain authentication, and content analysis across a message format rich enough to evaluate. Text messages are short, arrive through carrier networks with limited metadata, and use URL shorteners that obscure the destination. The tools designed to catch email phishing were not built for this channel, and retrofitting them has proven difficult.
Employee training closes some of the gap but not as much as organizations expect. Awareness programs can teach people to recognize common smishing patterns, but the click-through data suggests that the channel itself undermines vigilance. A text message feels urgent and personal in a way that email does not. The same person who pauses before clicking a suspicious email link will tap a suspicious text link without the same hesitation.
The CISA and FBI jointly recommended in December 2024 that organizations stop using SMS-based multi-factor authentication entirely, citing the channel’s vulnerability to interception and social engineering. The recommendation applies to all organizations, not just federal agencies.
What this means for retail brand protection programs
If your brand protection program is built around a Q4 peak model, three adjustments would bring it in line with what the data shows.
The first is monitoring intensity. June through August should carry the same staffing and alert thresholds as November through January. The data does not support treating summer as a lower-risk period.
The second is infrastructure coverage. The .shop TLD concentration during summer months means monitoring programs that focus on .com and country-code TLDs are missing a significant share of seasonal retail impersonation. Adding .shop to your monitoring scope is a straightforward adjustment with measurable impact.
The third is detection speed. The ten-hour victim window that applies to phishing generally compresses further during high-volume shopping periods, when customers arrive at fraudulent sites in buying mode and move from visit to credential exposure faster than in other contexts. Summer monitoring needs to match that tempo.
The Bottom Line
Smishing exploits the most trusted communication channel most people have. Text messages are read faster, clicked more often, and filtered less effectively than email, and the brands being impersonated in smishing campaigns have no control over what their customers receive. The volume is growing at roughly 40% per year, the tools built to stop it block less than a third of attempts, and the channel that regulators once recommended for security authentication is now the one they recommend against. For organizations whose brands are being used in smishing campaigns, the defense that matters is not filtering the messages. It is detecting and blocking the infrastructure they point to, the fraudulent pages and credential-harvesting sites, before your customers arrive. The same ten-hour victim window that applies to email phishing applies here with equal force.
Key Takeaways
Smishing is phishing delivered by text message. The term combines “SMS” and “phishing.” It uses fraudulent text messages to trick recipients into clicking malicious links, sharing credentials, or sending money.
The FTC reported $470 million in text scam losses in 2024, a fivefold increase from 2020. Smishing accounts for roughly 35% of all phishing and grew 40% year-over-year. Click-through rates for smishing messages are 19-36%, compared to 2-4% for email phishing.
Email has decades of filtering infrastructure including spam filters, DMARC, and domain reputation scoring. Text messages bypass nearly all of it, arriving through carrier networks built for reliability rather than security. Commercial anti-smishing tools block only 25-35% of threats.
Attackers impersonate banks, retailers, delivery services, and government agencies by text. The messages mimic legitimate brand communications that recipients already receive and trust. The FDIC identifies bank impersonation as the most common text scam category.
Monitor for the infrastructure that smishing campaigns point to rather than trying to filter the messages. The same aged-domain and legitimate-hosting patterns that apply to email phishing apply to smishing landing pages. Detection and blocking speed matter: 75% of victims arrive within ten hours.
