What is smishing? What the FTC, FBI and FCC say

Smishing names the channel, not a new trick

The FCC explained the word in a consumer blog of 2 March 2020: text scams are sometimes referred to as smishing, which it calls a mashup of SMS (short message service) and phishing. The FBI’s Internet Crime Complaint Center puts the same composition in a footnote to an alert of 12 April 2024, where it defines smishing as a social engineering attack that uses fake texts to get people to download malware, hand over sensitive information or send money to criminals. IBM gives the same two parts, and Experian opens with “SMS phishing”.

That answers the question of how smishing differs from phishing. The FBI footnote adds that phishing generally pertains to attacks on the internet, email or websites, so smishing is the version that arrives as a text. Cloudflare lists it as one of several kinds of phishing, next to email, phone calls (vishing), QR codes (quishing) and social media messages. IBM says the difference between them is the medium. Our page on smishing and vishing sets the two channel names side by side, and the one on the phishing email covers the email door.

The word comes from SMS, but the pages we read do not limit the scam to that technology. IBM says smishing attacks use SMS or messaging apps, and the FTC’s list of ways to report a scam text names the Apple iMessages app and the Google Messages app for Android users. The FTC and the FCC both write “text message”, and this page does the same.

Why the scam picks a text

The FCC’s blog gives the short version: scammers have noticed that many people may be more likely to respond to a text than to answer a call from a number they do not recognize. The FTC adds numbers in a footnote to its Data Spotlight of 14 April 2025, which it takes from a report by the FCC’s Consumer Advisory Committee of August 2022. The FTC says text open rates are estimated to be as high as 98 percent and response rates as high as 45 percent, against 20 and 6 percent for email, and that more than half of consumers text daily. These are estimates for texting in general, not for scam texts.

IBM argues the same point with different numbers. It cites a click-through range of 8.9 to 14.5 percent for marketing texts from Klaviyo and an average email click rate of 2 percent from Constant Contact. Those come from two marketing sources and measure clicks, where the FTC’s estimates measure opens and responses, so the two sets should not be added together. IBM also says a link is harder to judge on a phone, because a computer user can hover over a link to see where it leads and a smartphone user cannot, and because people are used to banks and brands sending shortened addresses by text.

IBM offers one further reason, which is its own argument. It says the FCC made telecom companies adopt the STIR/SHAKEN protocol in 2020, that this made scam calls easier to spot, and that it did not have the same effect on text messages, so many scammers moved on to smishing. The FTC and FCC pages we read do not make that argument.

The five texts reported most in 2024

The FTC’s Data Spotlight of 14 April 2025 says people reported $470 million in losses to scams that started with a text in 2024, more than five times the 2020 number, even though the number of reports declined. It gives the share of text scam reports that said money was lost as 5 percent in 2020, 4 in 2021, 6 in 2022, 9 in 2023 and 11 in 2024. It also says the vast majority of frauds are never reported, so the figure likely reflects only a fraction of the harm, and cites a study in which only 4.8 percent of those hit by mass-market consumer fraud complained to a Better Business Bureau or a government body.

The Spotlight describes five texts that it estimates account for about half of all text frauds reported to the FTC in 2024. The FTC found them by hand-coding a random sample of 1,000 reports that carried a narrative. In its order they are:

1. Fake package delivery problems. The most reported text scam, usually from someone pretending to be the Postal Service, with a link to a lookalike site. Many people reported paying a small redelivery fee that was a trick to get a credit card or Social Security number. Our page on the parcel text covers this one.
2. Phony job opportunities. A new “task scam” took off in 2024: an unexpected text offers work with no specifics, the work is simple repeated tasks such as rating products or apps, and at some point people are told to send money to finish the tasks and withdraw earnings. The FTC says people who sent money reported that they did not get it back.
3. Fake fraud alerts. Texts about suspicious activity or a big purchase, often looking like a bank or Amazon, with a number to call or a YES or NO reply. People who reply are connected to a fake fraud department, which pressures them to move money out of their accounts to supposedly keep it safe.
4. Bogus notices about unpaid tolls. Texts that look like they come from highway toll programs, from SunPass in Florida to FasTrak in San Francisco, telling people to click a link to pay an unpaid balance. The FTC says these scammers are after credit card and Social Security numbers.
5. “Wrong number” texts that aren’t. An out-of-the-blue message that might just say hello. The FTC says answering can start a fake friendship, often with romantic undertones, then talk of investing and a bogus platform; people report losing all they invest, often tens of thousands of dollars.

Other pretexts appear in a single glossary each and are not among the FTC’s five. IBM lists a boss or colleague asking for urgent help, a friend who claims to be locked out of an account and asks you to receive a code, and free apps that are malware. Cloudflare lists account verification, service cancellation and tax refunds. Experian lists a recruiter who asks for bank details for a background check. For the unasked-for code, our page on the Link verification code covers one version.

One text word for word, and its QR cousin

The FBI’s alert of 12 April 2024 prints the wording of one toll text. Since early March 2024 the Internet Crime Complaint Center had received over 2,000 complaints about such texts, from at least three states, and said the scam may be moving from state to state. The text opens with the name of a state toll service and says an “outstanding toll amount” of $12.51 is on your record. It warns of a late fee of $50.00 unless you visit a link to settle the balance. The complaints show almost identical language, but the link is made to impersonate the state’s toll service name and the phone numbers appear to change between states. We have left out the address in the alert on purpose.

For this text the FBI suggests five things: file a complaint at ic3.gov, including the number the text came from and the website listed in it; check your account on the toll service’s real website; call the toll service’s customer service number; delete the text; and, if you clicked a link or gave information, secure your personal information and financial accounts and dispute any unfamiliar charges.

A different notice reached the FTC in 2026. Its Consumer Alert of 14 April 2026 says a text carrying an image of an apparently official traffic hearing notice has produced a spike in reports in the last month. The FTC says the text might look official, with a seal from whatever state it claims to be from, a fake case number and a fake date and time for the hearing. It offers two options, go to the hearing or pay the fine now, lists default judgments, fines and enforcement actions if you do not respond, and asks you to scan a QR code to settle the balance. The FTC says scanning can lead to stolen personal information such as a Social Security or credit card number, malware on the phone and stolen money. Its advice is not to respond and not to scan, and to check the court’s website for case information or call the court directly, using a website or number you know is correct.

Set side by side, the two notices share three features: a small invented amount or a threatening one, a consequence that grows if you wait, and a quick way to pay inside the message itself. That comparison is ours.

What a tap does, and what the pages disagree on

The FCC’s 2020 blog says the link in a scam text could lead to a fake website asking you to log in, and that if you do, the scammer will have your credentials and will try to access multiple accounts with them. It adds that a click could also infect the phone with malware, especially if the phone’s operating system security is not up to date. The FTC’s page on spam texts says some links lead to a spoofed website that looks real, where a login can hand over a username and password, and that other messages might install malware that steals information without you realizing it.

The glossaries qualify the malware part. Experian says that receiving a sketchy text will not, on its own, infect a device or leak data, and that the way to avoid being a victim is to not engage with the texts and links. It adds that after a click, malware may be downloaded or the person may be sent to a login or billing screen. Cloudflare says the malware step occurs in only some smishing attacks, and that a malware download can follow loading the attacker’s page or being induced to download a malicious app. The FTC lists both outcomes and does not rank them. Read together, the login page appears on all four pages; Cloudflare says the malware step occurs in only some smishing attacks, and Experian says a text on its own will not infect the device.

Replying is a separate question. Cloudflare says attackers are often only checking whether a number is active, and that replying, even without revealing anything, still reveals too much, since attackers are likely to put more effort into people who answer. It describes unsigned messages such as “Are you in town?” as worded to look as if they come from someone the recipient knows, so that the recipient replies, and says it is not wise to reply even jokingly. The FCC’s tip is shorter: do not respond to texts from unknown numbers. Cloudflare also advises turning off read receipts, because with some SMS services a receipt tells the sender the message was read.

What to do, in order

The steps below put together what the FTC, the FCC, the FBI and the glossaries say. The order is ours, not a rule from any one of them.

1. Do not tap and do not reply. The FTC says not to click any link in an unexpected text that asks for personal or financial information, and that legitimate companies won’t ask for information about your account by text.
2. Check with the sender by a route you already know. The FTC says to contact the company using a phone number or website you know is real, not the information in the text. The FCC points to the number on a bill or statement, and says to call a friend whose text carries an odd link, in case the friend was hacked. The FCC also says government agencies almost never initiate contact by phone or text. The words “almost never” matter: our page on the parcel text explains that the Postal Service does send texts.
3. Report it. The FTC gives three ways: copy the message and forward it to 7726 (SPAM), which it says helps the wireless provider spot and block similar messages; report it in the messaging app; and report it at ReportFraud.ftc.gov. The FCC adds a complaint to the FCC. For the toll text, the FBI asks for a complaint at ic3.gov.
4. Then delete it. Experian and Cloudflare say to delete the message, and Cloudflare adds blocking the number. Forwarding needs the message in front of you, so reporting first is our reasoning, not an instruction from these pages.
5. Do not expect the number to stay blocked. Cloudflare says carriers typically block numbers if enough people report them, though scammers can switch or disguise their numbers, and the FBI says the numbers in the toll texts change between states. Our pages on spam texts and spoofed caller ID go further on filters and on the number shown.
6. If you tapped, typed or paid, act on the accounts. The FBI says to secure personal information and financial accounts and dispute unfamiliar charges. Experian lists updating the phone’s security software and running a scan, new passwords for the accounts involved, telling the bank or card issuer, a free fraud alert on credit reports, and monitoring. The FCC adds local law enforcement and the wireless provider, and the FTC points to its page on what to do if you were scammed.