Smishing, or SMS phishing, is social engineering delivered by text message. The victim receives a message impersonating a trusted sender, a delivery carrier, a bank, a retailer, and is pushed to click a link, reveal credentials, or hand over payment details. The name blends “SMS” and “phishing.”
How Smishing Works
Smishing exploits the trust and urgency of the text channel: messages arrive on a personal device, are read within minutes, and carry none of the spam filtering email has. Classic lures include fake delivery notifications (“your package is held, confirm your address”), fake fraud alerts from banks, and fake order confirmations designed to provoke a panicked click. The links lead to spoofed websites that harvest logins and card details. Consumers can report these scams through the FTC’s fraud reporting portal.
Why It Matters for Commerce Brands
Retail brands are both impersonated and downstream victims. Delivery-themed smishing borrows the names of carriers and stores shoppers already buy from, eroding trust in legitimate order notifications. And the credentials harvested come back to the store as account takeover and card not present fraud. Brands can blunt the impersonation by keeping their own SMS practices consistent: no login links in texts, a published sender identity, and clear guidance on what the brand will never ask for.
How Wyllo Helps
Wyllo can’t stop a text from being sent, but it catches what the stolen data is for. Wyllo Payment Fraud Protection screens orders placed with harvested credentials, and Wyllo Claim and Policy Abuse Prevention flags taken-over accounts before the damage spreads.
Frequently Asked Questions
How is smishing different from phishing?
Only the channel. Phishing arrives by email, smishing by text, and vishing by voice call. The psychology and the goal, stolen credentials and payment data, are the same.
Why are delivery notifications the most common smishing lure?
Because nearly everyone is expecting a package. A held-shipment message matches something true often enough that even careful people click, especially during holiday season peaks.
