Smishing (SMS Phishing)

The term was coined in 2006 by McAfee's David Rayhawk in the United States; no single first case is credited, and the industrial form dates from about 2023, when China-based kit sellers known as the 'Smishing Triad' began mass parcel, bank and toll-fee campaigns.

SMS phishing was named 'smishing' in 2006 by McAfee researcher David Rayhawk, after early texts luring phone users to premium-rate numbers and malicious downloads. It stayed a minor variant of phishing until smartphones made links clickable and banks moved to app and SMS security; from about 2018 fake parcel-delivery texts (Royal Mail, USPS, DHL), bank 'fraud alerts' and unpaid-toll notices became the standard lures. Since 2023 a China-based ecosystem, tracked by researchers as the 'Smishing Triad' and selling kits such as 'Darcula', 'Lighthouse' and 'Magic Cat', has industrialised it: kits impersonate hundreds of brands, messages are sent through iMessage and RCS to avoid carrier filters, and stolen cards are loaded into mobile wallets. In 2025 the same kits drove the wave of US toll-road texts. Criminals in the UK and elsewhere have also used 'SMS blasters', fake mobile base stations in cars, to text everyone nearby.

A text claims a parcel is held, a toll is unpaid, a bank account is locked or a job is available, with a link to a look-alike site that harvests card numbers, logins and one-time codes. Kits sold on Telegram provide the pages, the domains and live panels showing victims' entries; the gang then adds the card to Apple Pay or Google Wallet and spends it or buys gift cards. Messages are sent from SIM farms, compromised accounts, iMessage/RCS or a mobile 'SMS blaster' that forces nearby phones onto a rogue 2G cell. Because texts feel personal and phones show little of the URL, click rates are higher than for email.

A kit costs a few hundred dollars, SIM farms or iMessage accounts send millions of texts for almost nothing, and people open texts far more readily than email; the FTC found text-scam losses reached $470 million in 2024, five times the 2020 figure. Stolen cards are loaded into mobile wallets within minutes, so the fraud is monetised before banks react. Kit sellers sit in China and senders rotate numbers, so prosecutions are rare; the UK's SMS-blaster cases are among the first convictions anywhere.

US consumers reported $470 million lost to scams that began with a text in 2024 (FTC), part of the $20.9 billion in all internet-crime losses the FBI logged for 2025; no body publishes a global smishing total. The most extensive campaigns are the Smishing Triad's, which researchers say impersonate postal services and banks in over 100 countries, and the largest convictions are the UK SMS-blaster cases (up to 4 years). Victims lose card balances, and the fake parcel and toll texts erode trust in real notifications.