SecurityRingBook a Demo

Glossary

What is smishing? SMS phishing explained

SMS phishing: a text message with a link, number or request designed to steal credentials, money or access, often by moving the conversation to another app.

How it works

CISA describes smishing as social engineering that exploits SMS text messages. A text can carry links, email addresses or phone numbers that open a browser or dial a number with one tap, which makes acting on it quick and easy.

A real example

In May 2025 the FBI warned that, since April 2025, criminals had sent text messages and AI-generated voice messages claiming to come from senior US officials. One method was a malicious link presented as a move to a separate messaging platform. The FBI notes that smishers often use software-generated numbers not tied to a real subscriber.

How to train for it

  • Verify the sender through a number or contact you already have.
  • Be wary of a request to “move to another app” early in a conversation.
  • Open the service yourself instead of tapping a link in a text.

SecurityRing’s SMS simulations are coming soon and are not available today. QR-code email simulations, which also move the victim to a phone, are live.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. CISAAvoiding Social Engineering and Phishing AttacksAccessed 17 October 2026.
  2. FBI Internet Crime Complaint CenterSenior US Officials Impersonated in Malicious Messaging Campaign (PSA I-051525-PSA)Published 15 May 2025 · Accessed 17 October 2026.