# smishing

Source: https://startwithidentity.com/glossary/smishing/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Smishing, short for SMS phishing, is phishing delivered by text message: the attacker sends an SMS (or a chat message on a messaging app) that pushes the target to open a link to a fake sign-in page, call a number, or install an app. MITRE ATT&CK lists it under [Phishing (T1660)](https://attack.mitre.org/techniques/T1660/) for Android and iOS, noting that attackers use "social engineering techniques in text messages to trick the victims into acting quickly."

In identity attacks the text is a delivery step, and the payload is a credential and MFA relay. The [0ktapus campaign](https://startwithidentity.com/breaches/incidents/2022-0ktapus-phishing-campaign/) in 2022 sent texts linking to fake Okta pages and, per Group-IB, captured 9,931 credential sets and 5,441 MFA codes from more than 130 organizations; [Twilio](https://startwithidentity.com/breaches/incidents/2022-twilio-sms-phishing/) was one victim. In the [2023 Retool incident](https://startwithidentity.com/breaches/incidents/2023-retool-sms-phishing-authenticator-sync/) a payroll-themed text was followed by a deepfaked IT call that collected the MFA code.

| Smishing | Related but different |
|---|---|
| Lure arrives by SMS or messaging app | [Vishing](https://startwithidentity.com/glossary/vishing/): the lure is a phone call |
| Usually links to a credential-harvesting page | [SIM swap](https://startwithidentity.com/glossary/sim-swap/): attacker takes over the phone number itself |
| Defeated by origin-bound authenticators | Not stopped by SMS or TOTP codes, which the page relays |

It matters because mobile screens hide the full URL and texts feel personal, and because the same channel often carries the OTP the attacker wants. The fix that worked in the record is technical: Cloudflare was targeted by the same 0ktapus wave and stopped it with FIDO2 security keys, because a [passkey](https://startwithidentity.com/glossary/passkey/) or security key will not sign for a lookalike domain. Training helps at the margin; [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) closes the gap. Note that [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) already treats SMS as a restricted authenticator.

See also: [OTP relay social engineering](https://startwithidentity.com/techniques/otp-relay-social-engineering/), [AiTM phishing proxy](https://startwithidentity.com/techniques/aitm-phishing-proxy/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [adversary-in-the-middle](https://startwithidentity.com/glossary/adversary-in-the-middle/), [best phishing-resistant MFA](https://startwithidentity.com/rankings/best-phishing-resistant-mfa/)