What is smishing? Smishing is phishing by text message: a short message that tries to get the reader to tap a link, pay something, or start a conversation with a scammer. CISA defines it as "phishing via text messages to get the victim to click on a link, download files and applications, or begin a conversation."

For a business, the target is rarely the company phone system. It is the phone in every employee's pocket, which receives work requests and personal texts in the same thread of attention. This piece extends how phishing actually works and how to spot it to the version that arrives by SMS.

A smartphone lying face down on a dark wooden desk with hot pink light spilling from beneath its edges, for an article on what is smishing — The work phone and the personal phone are usually the same device, and the texts land side by side.

What is smishing, and why does it work on staff phones?

Text messages feel personal and immediate. People read them between tasks, on small screens that hide most of a link, and often before they have opened a laptop for the day. I study behavioral psychology, and those are exactly the conditions in which people decide fast and check less.

Verizon's 2026 Data Breach Investigations Report offers an early signal: in phishing simulations, the median click rate for phone-centric methods such as texts was about 40% higher than for email. Verizon calls its phone-based sample "small-ish," so treat the gap as a hint, not a settled finding.

The broader pattern is better established. The same report found the human element present in 62% of breaches, a reminder that the person holding the phone is part of the system, whatever channel the request arrives on.

What do smishing texts aimed at employees look like?

The most common business version is the boss who needs a favor. The FTC's January 2026 alert describes an unexpected text, email, or call from your "boss" asking for something urgent: buy gift cards, then send the numbers. The FTC notes the request may also ask for "Google certificates."

The script works because it borrows rank and adds pressure. A new employee does not want to keep the CEO waiting, and the text arrives when checking feels awkward. The fix is a rule the CEO announces personally: nobody here will ever ask you to buy gift cards by text.

A fan of blank plastic gift cards on black with a hot pink edge light, the boss gift card request common in smishing — The FTC is direct about this one: only scammers ask for gift card numbers and PINs.

The second family imitates services everyone uses. In its April 2025 Data Spotlight, the FTC listed the five most-reported text scams of 2024: fake package delivery problems, phony job opportunities, fake fraud alerts, bogus notices about unpaid tolls, and "wrong number" texts. Staff who handle shipping, accounts payable, or recruiting see the business versions of all five.

A third family uses text to open a door for a call. The FBI's May 2025 PSA describes a campaign impersonating senior US officials through text messages and AI-generated voice messages. A text that says "call me on this number" is the first half of a vishing attack, which is covered in what is vishing.

How big is the smishing problem for businesses?

The FBI's broadest phishing category includes text scams. The IC3 2025 Internet Crime Report defines phishing and spoofing as unsolicited email, text messages, and calls "purportedly from a legitimate company," and that category drew 191,561 complaints in 2025, more than any other.

The FTC's data shows how much of this is impersonation. In a June 2026 release, it reported that imposter scams were the most-reported fraud category in 2025, with $3.5 billion lost, including nearly $1 billion to people posing as businesses.

In the FTC's own data, which counts only losses people chose to report, text scams cost $470 million in 2024. That is the most recent year for which the FTC has published a breakdown of the top text scams by type.

A plain cardboard parcel on a dark doorstep with a single hot pink light falling across it, the fake delivery notice behind many smishing texts — Fake delivery problems were among the five most-reported text scams of 2024, according to the FTC.

What should an employee do with a suspicious text?

Do not tap the link and do not call any number in the message. If the text claims to be from your manager, the FTC's advice is to check with them using a phone number or email you know is real. If it claims to be from a vendor, a carrier, or a toll agency, go to their site or app yourself.

Report it twice: once inside the company, so the person who manages your systems can warn others, and once to the carrier. The FTC's phishing guidance says: "If you got a phishing text message, forward it to SPAM (7726)."

If someone already paid, speed matters. The FTC's guidance for scam victims says to contact the gift card issuer immediately for gift cards, and to report a bank transfer to the bank right away and ask them to reverse it.

How do you set a company up so a text cannot move money?

Write down what a text can never authorize. Payments, gift cards, bank detail changes, password resets, and login codes should all be off limits by text, and the policy should say so in one plain sentence. Writing a security policy without a security team covers how to keep that short enough that people read it.

Then make a stolen password less useful. Many smishing links lead to fake login pages. CISA calls phishing-resistant MFA "the gold standard" and urges organizations to make migrating to it a high priority, and what is MFA fatigue explains why push approvals alone are not enough.

Finally, route payment requests through a system that requires verification, whatever channel they arrive on. What is business email compromise shows how the same request moves from text to email to phone, and why the control has to sit in the payment process rather than in anyone's judgment on a busy afternoon.

An empty highway toll gantry at night lit only by hot pink light over wet asphalt, the unpaid toll notice used in smishing — Unpaid toll notices made the FTC's 2024 top five. Go to the agency's site yourself, never the link.

Not sure? Check before you act

When a text asks for money, a code, or a login, run through these steps. The full method is in how to check if a message is a scam.

Stop. The deadline in the text is part of the scam.
Read the sender and any link domain letter by letter. Short codes and unknown numbers prove nothing.
Look the company or person up yourself and call back on a number you already have.
Screenshot the text and ask your company's approved AI assistant whether the company is real, whether the domain matches, and whether it fits a known scam. Crop out customer and personal data, never upload attachments, and treat the answer as a second opinion.
Report it the company way, and forward it to 7726.
If money or a login was involved, call your bank to request a recall of the funds and file a complaint at ic3.gov.

At Kief Studio we build the verification into the systems themselves, so a payment or a login approval cannot go through on the strength of a single text. We also run remote team sessions on exactly this: the messages your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is smishing in simple terms?

Smishing is phishing by text message. The text pretends to come from someone you trust, such as your manager, a delivery company, a bank, or a toll agency, and tries to get you to tap a link, pay, or reply.

Why do scammers text employees pretending to be the boss?

Because rank and urgency discourage checking. The FTC's January 2026 alert describes texts from a fake "boss" asking staff to buy gift cards and send the numbers. The FTC's advice is to confirm with your boss using a number or email you know is real.

Where do I report a smishing text?

Inside your company first, then forward the text to SPAM (7726), as the FTC recommends. You can also report fraud at ReportFraud.ftc.gov, and if money was lost, file a complaint at ic3.gov.

Are employees more likely to fall for texts than emails?

Possibly. Verizon's 2026 report found the median click rate in phone-centric phishing simulations was about 40% higher than for email, but Verizon describes its phone-based sample as small, so it is an early signal rather than proof.

Smishing

What Is Smishing? Text Scams Aimed at Your Staff