Smishing
Smishing is phishing by text message: a scam text that tries to get you to click a link, reply or share personal or payment information.
Also called: SMS phishing, text message phishing, scam text
Smishing is phishing by text message: a scam text that tries to get you to click a link, reply or share personal or payment information.
What it means
Smishing is phishing carried out by text message. The word blends SMS and phishing. A smishing text pretends to come from a bank, delivery service, government agency or settlement, and tries to get you to tap a link, reply or share information. CISA treats it as a form of social engineering, meaning a trick aimed at people rather than computers.
The FTC says scam texts may promise prizes, claim there is a problem with an account, payment or package, or offer help with debts. Links in them can open pages made to imitate a real company, where logging in hands your password to scammers. A real business does not ask for your account details by unsolicited text.
Settlement texts are a common disguise. A message saying you have money waiting from a class action, with a link to claim it, may be smishing.
What it means for you
Do not tap links or reply to unexpected texts. If a text might be real, look up the company or settlement yourself and use the contact details you find, not the ones in the message. To report it, copy the message and forward it to 7726 (SPAM), use your messaging app's report option, report it to the FTC at ReportFraud.ftc.gov, and delete it. If you entered a password or account details, change them now. If you shared your Social Security number, card or bank number, IdentityTheft.gov lists steps based on what you gave out.
Example
Say you get a text: "You have an unclaimed settlement payment. Confirm your bank details here." You never filed a claim, and the link looks odd. You do not tap it. You search for the settlement name and find no such payout, then forward the text to 7726, report it to the FTC and delete it.
FAQ
Copy the message and forward it to 7726 (SPAM), use your messaging app's report option, and report it at ReportFraud.ftc.gov. Then delete the text.
Do not enter any information. If you logged in or shared details, change those passwords and contact the company. If you gave out a Social Security, card or bank number, IdentityTheft.gov explains what to do next. If a link may have installed software, update your security software and run a scan.
Related terms
- CISA, Avoiding social engineering and phishing attacks
- FTC, How to recognize and report spam text messages
- FTC, How to recognize and avoid phishing scams
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.