What is smishing—and how this new SMS scam could drain your bank account

Imagine glancing at your phone and seeing an urgent text from “Your Bank” warning of suspicious activity. In a heartbeat, you tap the link—only to discover you’ve handed over your banking details to a cybercriminal.

What Is Smishing?

Smishing, a blend of “SMS” and “phishing,” is the art of duping people via text message. Much like traditional email phishing, its success hinges on social engineering: tricking recipients into believing they’re dealing with a genuine organisation. Whether it’s a bogus alert from your bank, a delivery update from a courier, or a warning about unpaid fines, these messages prey on our instinct to act fast when it comes to our finances.

SMS Phishing: An Effective Phishing Technique

I’ll never forget the time my elderly neighbour nearly fell for a smishing attack. She received a text claiming her parcel from Royal Mail was pending payment; the message was peppered with just enough detail to feel authentic. Before she could call me, the SMS urged her to click a link. Only after a quick call to Royal Mail’s official helpline did we realise it was a trap. According to the UK’s National Cyber Security Centre, smishing incidents climbed by nearly 300 per cent between 2022 and 2023, as fraudsters exploit our tendency to trust short, urgent texts.

A Rapidly Growing Cyber Threat

Over the last few years, SMS has become a go-to channel for banks, airlines and even the NHS to send appointment reminders or security codes. Cybercriminals have quietly slipped their malicious texts among these legitimate notifications. The result? Your inbox swells with harmless updates and hidden threats alike. Global security firm Proofpoint reports that smishing campaigns now account for more than 50 per cent of all mobile phishing attempts—a figure that shows no sign of slowing down.

How Smishing Works

At its core, smishing follows a simple playbook:

1. Impersonation: The attacker spoofs a known sender—your bank, mobile operator or tax authority—and claims there’s an immediate problem.
2. Action Request: You’re urged to click a link, call a number or download an app to “resolve” the issue.
3. Data Capture or Malware Install: The link directs you to a convincing fake website where you’re prompted for personal data—bank login details, card numbers or passwords—or it installs malware that silently harvests information.

Some variations even feature premium-rate numbers: calling the “support line” racks up exorbitant charges while you spill sensitive info to a fake agent.

Spotting the Red Flags

Even the savviest smartphone user can be caught off guard, but there are tell-tale signs:

• Spelling mistakes or odd phrasing: Official organisations rarely get their own name wrong.
• Suspicious links: Hover over a URL to check the real destination before you tap.
• Unsolicited urgency: Genuine messages may alert you to issues, but they won’t force you into a panicked click.

If you’re ever in doubt, contact the organisation directly using contact details from their official website. As Action Fraud advises, never respond to questionable texts or provide any login credentials via SMS.

Protecting Yourself Against Smishing

Fortunately, there are practical steps to stay one step ahead:

• Enable SMS filtering: Both iOS and Android offer basic spam filtering to quarantine suspicious messages.
• Use a mobile security app: Trusted providers like Avast and Norton can detect and block malicious links in real time.
• Stay informed: Regularly review your bank statements and set up transaction alerts to spot odd activity immediately.

Training is equally important. In workplaces, roll out regular briefings on cyber hygiene and encourage staff to report any dubious texts through official channels.

What to Do If You’ve Been Targeted

If you suspect you’ve clicked on a smishing link:

1. Don’t panic: Disconnect from the internet and avoid further interaction with the message.
2. Document the attack: Take screenshots—these can help investigators.
3. Notify your bank: Freeze your account if necessary, and change your passwords.
4. Report the scam: In the UK, contact Action Fraud or forward the SMS to 7726 (SPAM).

Smishing may feel like a modern twist on an old trick, but with vigilance, education, and the right tools, you can keep your personal and financial information safe. After all, the best defence is knowing that not every text is as harmless as it looks.