Why Text Message Phishing (Smishing) Is Rising, and How to Prepare Your Team

Your email security gateway stops most phishing emails before they reach an inbox. That success has pushed attackers to SMS. A text has no spam filter, no link preview and no IT department scanning it.

Why SMS phishing works

Text messages have a 98% open rate. People read every text they get, usually within minutes. There's no "mark as spam" button that learns over time. On a phone screen, it's harder to inspect a link before you tap it.

Attackers know this. SMS phishing (smishing) attacks increased over 300% in the past two years, and the attacks are getting more sophisticated.

What these attacks look like

The most common smishing messages copy everyday notifications:

• Package delivery. "Your UPS package couldn't be delivered. Reschedule: [link]"
• Bank alerts. "Unusual activity on your account. Verify now: [link]"
• MFA bypass. "Your verification code is 847291. If you didn't request this, secure your account: [link]"
• HR/Payroll. "Your direct deposit info needs updating before next pay period: [link]"
• IT support. "Your company email password expires today. Reset here: [link]"

These work because they create urgency and look like messages people get every week. The attacker doesn't need to get past any security tool. The message goes straight to the employee's phone.

Why most training programs miss this

Most phishing training covers email only. That leaves a blind spot. Your employees might spot a fake Microsoft login page in their inbox every time, then fall for a convincing text.

How to prepare your team for SMS phishing

Mobile carriers don't allow simulated phishing texts, so you can't safely run a fake-text test the way you can with email. Training is how you close the gap:

1. Teach one rule: never tap a link in a text you weren't expecting. Go to the app or website directly instead.
2. Verify through a different channel. If "the bank" or "IT" texts you, call the number you already know.
3. Treat any text that asks for a code, a password or a payment as suspicious, however official it looks.
4. Make reporting easy, and thank people who report a scam text, even when it turns out to be real.

Start with email, then build habits that carry over

Run regular email simulations to set a baseline and keep your team alert. The habits they build (slow down, check the sender, don't tap the link) carry over to their phones. PhishPlease training includes a level on text, phone and QR-code scams, so your team learns what smishing looks like too.