What is smishing? Phishing by text, aimed at the phone in every employee's pocket. Imposter scams were the most-reported fraud to the FTC in 2025, with $3.5 billion lost. Here is what work-targeted texts look like and how to report them to 7726.
What is smishing? Smishing is phishing by text message: a short message that tries to get the reader to tap a link, pay something, or start a conversation with a scammer. CISA defines it as "phishing via text messages to get the victim to click on a link, download files and applications, or begin a conversation."
For a business, the target is rarely the company phone system. It is the phone in every employee's pocket, which receives work requests and personal texts in the same thread of attention. This piece extends how phishing actually works and how to spot it to the version that arrives by SMS.
Text messages feel personal and immediate. People read them between tasks, on small screens that hide most of a link, and often before they have opened a laptop for the day. I study behavioral psychology, and those are exactly the conditions in which people decide fast and check less.
Verizon's 2026 Data Breach Investigations Report offers an early signal: in phishing simulations, the median click rate for phone-centric methods such as texts was about 40% higher than for email. Verizon calls its phone-based sample "small-ish," so treat the gap as a hint, not a settled finding.
The broader pattern is better established. The same report found the human element present in 62% of breaches, a reminder that the person holding the phone is part of the system, whatever channel the request arrives on.
The most common business version is the boss who needs a favor. The FTC's January 2026 alert describes an unexpected text, email, or call from your "boss" asking for something urgent: buy gift cards, then send the numbers. The FTC notes the request may also ask for "Google certificates."
The script works because it borrows rank and adds pressure. A new employee does not want to keep the CEO waiting, and the text arrives when checking feels awkward. The fix is a rule the CEO announces personally: nobody here will ever ask you to buy gift cards by text.
The second family imitates services everyone uses. In its April 2025 Data Spotlight, the FTC listed the five most-reported text scams of 2024: fake package delivery problems, phony job opportunities, fake fraud alerts, bogus notices about unpaid tolls, and "wrong number" texts. Staff who handle shipping, accounts payable, or recruiting see the business versions of all five.
A third family uses text to open a door for a call. The FBI's May 2025 PSA describes a campaign impersonating senior US officials through text messages and AI-generated voice messages. A text that says "call me on this number" is the first half of a vishing attack, which is covered in what is vishing.
The FBI's broadest phishing category includes text scams. The IC3 2025 Internet Crime Report defines phishing and spoofing as unsolicited email, text messages, and calls "purportedly from a legitimate company," and that category drew 191,561 complaints in 2025, more than any other.
The FTC's data shows how much of this is impersonation. In a June 2026 release, it reported that imposter scams were the most-reported fraud category in 2025, with $3.5 billion lost, including nearly $1 billion to people posing as businesses.
In the FTC's own data, which counts only losses people chose to report, text scams cost $470 million in 2024. That is the most recent year for which the FTC has published a breakdown of the top text scams by type.
Do not tap the link and do not call any number in the message. If the text claims to be from your manager, the FTC's advice is to check with them using a phone number or email you know is real. If it claims to be from a vendor, a carrier, or a toll agency, go to their site or app yourself.
Report it twice: once inside the company, so the person who manages your systems can warn others, and once to the carrier. The FTC's phishing guidance says: "If you got a phishing text message, forward it to SPAM (7726)."
If someone already paid, speed matters. The FTC's guidance for scam victims says to contact the gift card issuer immediately for gift cards, and to report a bank transfer to the bank right away and ask them to reverse it.
Write down what a text can never authorize. Payments, gift cards, bank detail changes, password resets, and login codes should all be off limits by text, and the policy should say so in one plain sentence. Writing a security policy without a security team covers how to keep that short enough that people read it.
Then make a stolen password less useful. Many smishing links lead to fake login pages. CISA calls phishing-resistant MFA "the gold standard" and urges organizations to make migrating to it a high priority, and what is MFA fatigue explains why push approvals alone are not enough.
Finally, route payment requests through a system that requires verification, whatever channel they arrive on. What is business email compromise shows how the same request moves from text to email to phone, and why the control has to sit in the payment process rather than in anyone's judgment on a busy afternoon.
When a text asks for money, a code, or a login, run through these steps. The full method is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a payment or a login approval cannot go through on the strength of a single text. We also run remote team sessions on exactly this: the messages your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.
Smishing is phishing by text message. The text pretends to come from someone you trust, such as your manager, a delivery company, a bank, or a toll agency, and tries to get you to tap a link, pay, or reply.
Because rank and urgency discourage checking. The FTC's January 2026 alert describes texts from a fake "boss" asking staff to buy gift cards and send the numbers. The FTC's advice is to confirm with your boss using a number or email you know is real.
Inside your company first, then forward the text to SPAM (7726), as the FTC recommends. You can also report fraud at ReportFraud.ftc.gov, and if money was lost, file a complaint at ic3.gov.
Possibly. Verizon's 2026 report found the median click rate in phone-centric phishing simulations was about 40% higher than for email, but Verizon describes its phone-based sample as small, so it is an early signal rather than proof.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
What is pretexting? An invented story that makes a request for money, data or access feel routine. Verizon's 2026 DBIR found a human element in 62% of breaches. Why conscientious people get caught, and how callbacks stop it.
Phishing isn't just bad grammar in a Nigerian prince email anymore. AI-generated phishing is personalized, grammatically perfect, and harder to spot than ever.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
