The channel

Why SMS gets through

0% complete · 8 min · Introductory · Written lesson · Free under CC-BY-4.0

Smishing is phishing delivered by SMS or a mobile messenger. There is no link preview on most phones, users trust a rare text more than a crowded inbox, and the email security stack is not in the path at all.

The four dominant pretexts in 2026 are a package that needs a fee, a bank-fraud alert, a tax or fine notice, and a corporate IT helpdesk asking you to refresh a login. The kits are off the shelf, with brand templates for couriers, banks and tax authorities.

Any link in an SMS Especially a shortener, a lookalike, or an odd TLD. Type the official site or open the app instead.
Act now Package returned, account closed, fine doubles after midnight. The clock is the trap.
No name An organisation that has your number usually has your name. Generic greetings are a tell.
OTP you did not ask for Someone is logging in as you. That is an incident, not a glitch.

Your progress stays in this browser. It is never sent to us. No account, no email, no analytics on these pages.

Reviewed and signed off by

Peer review pending - no reviewer has been recorded for this module yet.