Smishing: Fake Text Messages and How to Defend Against Them

What is smishing?

Smishing is phishing over SMS, from "SMS" and "phishing". The victim gets a short message impersonating a bank, a courier, a government body or a telecom provider, meant to prompt a click or a call back to a given number. Polish law treats it as a distinct category of abuse: the Act of 28 July 2023 on Combating Abuse in Electronic Communication defines smishing as sending a message in which the sender impersonates another entity in order to induce a particular behaviour from the recipient.

Compared with email the attacker holds several advantages at once. No headers to inspect. No URL preview. No corporate filter. What there is instead is trust in a channel that normally carries genuine bank notifications. It is one of the more common variants covered in our guide to types of phishing, and for a few years now it has increasingly targeted employees rather than only private individuals.

Two things are worth separating straight away, because in practice they get confused more than anything else. Smishing is a delivery channel, not a class of fraud. The same fake payment gateway can arrive by text, as a QR code on a printed sheet, or in a phone call using a cloned voice. What changes is only what the defence can see along the way, and that is exactly what decides which controls stand any chance of working.

Where SMS sits among attack channels

Higher than the number of deployed controls would suggest. Verizon reports in the 2026 DBIR that the human element was present in 62% of breaches, and that social engineering was the third most common breach pattern, accounting for 16% of cases. The authors flag a shift of channel: social attacks carried over the phone, meaning text messages and voice, perform better in their dataset than the traditional email vector that defenders have spent a decade hardening.

In simulations the difference is measurable. The median click rate in email campaigns was 1.4%, while campaigns run over phone-centric vectors sat closer to 2%, an increase of 40%. Verizon attaches a caveat to that figure which is worth repeating: far fewer providers run SMS and voice simulations than run email ones, so the sample for the phone channel is small. The direction is consistent with the rest of the data, though, and the order of magnitude is enough to stop treating SMS as a footnote.

The same report shows how often organisations meet this channel at all: the median number of SMS phishing campaigns aimed at mobile devices was 48 a year in large organisations and 12 in smaller ones. The important qualifier is that those campaigns were only visible because the devices were managed. A personal handset that an employee uses to read company mail appears in none of these statistics.

The view from the other side looks similar. The Anti-Phishing Working Group recorded 971,181 phishing attacks in the first quarter of 2026, up 13.8% on the previous quarter, while phone-delivered fraud, meaning vishing and smishing together, rose 15% over the same period. The most attacked brand category became telecoms, which jumped from 5.9% of all attacks in Q3 2025 to 33% in Q1 2026. That matters for the content of the lures: impersonating a mobile operator has stopped being a niche scenario.

Why SMS is effective

Not because it is clever, but because every layer of defence that email relies on simply disappears in this channel. The same link that passes through a gateway, domain reputation and a sandbox in email lands straight on the screen in a text. The properties that work in the attacker's favour:

• No headers. SMS has no equivalent of SPF, DKIM or DMARC, so there is no way to check who actually sent the message
• No corporate filter. An email gateway cannot see SMS traffic, and the only filtering happens in the operator network, against a pattern that has to exist first
• Trust in the channel. The same channel carries genuine authorisation codes and transaction alerts
• A device outside control. A personal handset has no policies, no agent and none of the logs a company laptop has
• A truncated address. A narrow screen shows the start of a domain, not the end, which is the part that decides where the link actually goes
• Shortened links are the norm here, so a shortener does not look out of place the way it does in email
• We read on the move. The decision takes seconds, usually while doing something else

The last point is the most awkward one for organisations. Smishing aimed at an employee almost always lands on a personal device that the security team cannot see, and cannot be expected to see. There is no telemetry to collect and nothing to block, so the incident surfaces only through its consequences: an unusual sign-in, a reset password, a transfer. That is a genuine hole in the BYOD model and no licence closes it. Procedure and a fast reporting route do.

How the attack works, step by step

The Polish specifics: the 8080 number, patterns and statute

Poland has one of the better documented pictures of this in Europe, because it combines a dedicated free reporting channel on the number 8080 with a statutory duty to block. The figures below come from the CERT Polska annual report for 2025, published in April 2026:

• Over 350,000 messages analysed from reports sent to 8080
• Over 80,000 identified as harmful, the lowest count since 2022
• 790 smishing patterns developed and used to block campaigns
• Around 1.88 million malicious texts blocked, 27% more than in 2024

Those two numbers are worth reading together, because they move in opposite directions. Blocks rose by more than a quarter while harmful messages in reports hit their lowest level since 2022. The pattern mechanism does exactly what it was designed to do: a campaign blocked earlier reaches fewer people, so fewer people have anything to report. That does not shrink the phenomenon by itself. It moves the point at which the message gets stopped.

It is worth understanding that none of this rests on operator goodwill. The Act of 28 July 2023 on Combating Abuse in Electronic Communication requires CSIRT NASK to monitor smishing and build a message pattern, and requires telecoms operators to block texts matching such a pattern. Failure carries a penalty of up to 3% of an operator's annual revenue, plus a personal penalty for the responsible manager of up to 300% of monthly salary. Running a smishing operation is a separate criminal offence, punishable by three months to five years of imprisonment.

The machinery reached full strength in stages. The Act entered into force on 25 September 2023. The smishing information exchange system, through which operators submit suspicious messages and CSIRT NASK returns patterns, started on 17 January 2024. From 25 March 2024, blocking messages that match a pattern became an obligation rather than an option. That makes 2025 the first full year with figures from a working mechanism, and it explains why the number of blocks jumped by more than a quarter precisely then.

The second leg of the system is the Warning List of dangerous websites, run by CERT Polska since March 2020. A domain on the list is blocked at operator level, so even after a click the page will not open. In 2025 around 250,000 domains were added, 166% more than the year before, taking the list past half a million entries since launch and around 140 million blocked access attempts. It is a real second line, but it only starts working after a report, so the first hour in the life of a new domain stays uncovered.

The practical conclusion for an organisation is simple: reporting has an effect. All 790 patterns were built from messages passed on by people and by operators. Forwarding a suspicious text to 8080 takes about fifteen seconds, costs nothing on any operator in Poland, and shortens the campaign for every other recipient, not only for the person who reported it.

Sender ID spoofing: why the name on a text proves nothing

The sender field in an SMS is plain text. The protocol provides no authentication for it, so a bulk sender can put any string there and the handset will display it without objection. The side effect is worse than the forgery itself: the operating system groups messages by sender name, so a spoofed text can land in the very thread that holds genuine bank notifications, next to last week's authorisation codes. The thread context then does the work of credibility.

Polish law tries to close at least part of that gap. CSIRT NASK maintains a register of sender IDs reserved for public entities, and the President of UKE maintains a public register of SMS integrators authorised to send on their behalf. Operators are required to block a message carrying a reserved sender ID if it was not sent through a listed integrator. The register is deliberately split into a public part, the list of sender IDs that can be trusted, and a confidential part, the catalogue of malicious variants of those names, so as not to hand attackers a list of what they have yet to try.

The limit of that mechanism matters for private readers and organisations alike. Sender ID protection covers public entities, not every brand. A bank, a courier or a retailer has no automatic place in that register, so a sender name suggesting a private company remains a field that must not be treated as proof. The working rule has not changed in years: a sender name is not an identity, and the thread a message sits in is not authentication.

What the operator cannot block: SMS blasters

Those 1.88 million blocked messages are a ceiling, not a floor. The figure only covers texts that travelled through the operator network, because that is the only place where content can be matched against a pattern. A second delivery path is growing alongside it, and none of that machinery applies to it.

An SMS blaster is an IMSI catcher configured for the job, a device that impersonates a mobile base station. It fits in a car boot. Phones within range attach to it instead of the operator network and are then forced down to 2G. On 2G the network never authenticates itself to the handset, so the device can push a message with any sender ID straight onto the screen. No pattern and no operator filter sees it, because the message never enters the network.

This is neither theoretical nor exotic. The mobile industry has named the problem, and courts have already handed down sentences:

• GSMA, September 2025: the Asia Pacific operator taskforce described SMS Blasters as portable fake base stations that fit in a car boot or a backpack, auto-configure to the surrounding network and require no technical expertise to operate, and called on governments and law enforcement for support
• United Kingdom, March 2025: a student from China drove an SMS Blaster around London in the boot of a car for six days, pushing lures at tens of thousands of potential victims; he was stopped while the device was running, and officers nearby received fraudulent texts carrying the tax authority sender name
• United Kingdom, June 2026: a second man from the same investigation was sentenced to 48 months in prison for supplying articles for use in fraud, in a case run by City of London Police

No case has been publicly confirmed in Poland, but the hardware is the same across Europe and CSIRT NASK patterns by definition do not reach it. The defence is different from the usual one too, because it sits on the phone rather than in the network. Android 12 and later expose an "Allow 2G" toggle in the mobile network settings. On iPhone, 2G and 3G are switched off together with Lockdown Mode. That single setting closes the whole path, at the cost of coverage in places where only 2G remains.

A blaster is the extreme case of a broader rule: network-side filtering only works on what travels through the network. The same gap applies to bulk SMS gateways rented outside the recipient's country and to SIM cards bought in volume for sending from handsets. That is why the sentence "the operator will block it" is only conditionally true, and makes a poor foundation for a corporate procedure.

RCS and iMessage: the same script in an encrypted channel

Phones stopped receiving only SMS a long time ago. RCS on Android and iMessage on Apple devices look identical to an ordinary text in the inbox, but technically they are messengers: the traffic is end-to-end encrypted and travels over the internet rather than the operator signalling network. The consequence for defenders is direct and inconvenient. The operator cannot see the content, so there is nothing to match against a CSIRT NASK pattern, and the statutory duty to block refers to SMS messages.

Filtering then moves into the app on the handset and into user reports, which, as the GSMA points out, is what operators lean on to detect campaigns that bypass the network. For the reader that means one thing: the visual advantage of the newer channel, meaning nicer formatting, images, read receipts and a sender profile with a name and a logo, is not proof of authenticity but better staging. The criterion stays what it was for SMS: whether the message asks you to open a link and hand over data nobody legitimate needs.

The most common scenarios

Campaigns recycle a handful of proven templates, and knowing them in advance handles most of the problem. The table below reads in one direction: from the pretext, through what the message is really asking for, to the signal that settles the matter without opening any link.

One rule runs through all of them, regardless of pretext. Every scenario asks for an action that the institution in question never initiates by text: handing over card details, logging in through someone else's link, or retyping a code. As long as verification happens through the channel the sender chose, all we are checking is what the attacker wanted us to see.

How to recognise a fake bank text

A row-by-row comparison works better than a list of warnings, because genuine notifications are also terse and also sometimes alarming. The difference is not the tone but what the message asks for and where it leads.

One row deserves a sentence of its own, because the Polish Banks Association repeats it in every awareness campaign: a bank does not ask for login credentials in a text message. If a message asks, the matter is settled, no matter how the sender name looks or which thread it sits in.

The first 60 minutes after a click

Order matters here more than speed. First you cut off the instrument that can move money, then access to the account, and only then do you file reports. The procedure below assumes the worst case: card details or login credentials have already been entered.

1. 0–5 minutesThe person who clicked
   Stop and document

   Close the page and enter nothing further, even if the form asks for "one last code". Take a screenshot of the message including the sender name, and a screenshot of the open page. That is the material for the report and for any police statement, and it cannot be recovered once the message is deleted.

2. 5–15 minutesThe person + the bank
   Block the card and tell the bank

   Block the card in the banking app or by phone. If you cannot reach the app, the Polish Banks Association runs a nationwide card blocking service on 828 828 828, staffed around the clock, which transfers you to the right bank. Call only the number on the back of the card, in the app, or on the official site, never the number from the message.

3. 15–30 minutesThe person who clicked
   Cut off account access

   From a different, trusted device, change the banking password and the password on the mailbox used at registration. Review trusted devices, saved payees, transfer limits and contact details. If the same password is used elsewhere, change it there too, because data from the form circulates well beyond this one campaign.

4. 30–45 minutesThe person or the security team
   Report through the channel that actually blocks

   Forward the text to 8080 using the forward function. Report the page address through the form at incydent.cert.pl. The first report feeds the pattern distributed to operators; the second sends the domain to the Warning List, after which the page stops opening for customers of Polish operators.

5. 45–60 minutesThe affected person
   Notify law enforcement

   If money was lost or someone else's transaction was approved, file a report with the police and attach the screenshots, the sender number or sender ID, and the times involved. Notifying the bank and filing a police report are two separate things and one does not replace the other.

6. First 24 hoursSecurity team
   Check whether this was only the beginning

   If the affected person has access to company resources, treat this as an identity incident: review the last day of sign-ins, revoke sessions, and check mail forwarding rules and any authentication methods registered after the event. We describe the same pattern under account takeover that bypasses MFA.

Two steps in this procedure are habitually done too late. Blocking the card gets postponed until the call with the bank, although it takes seconds in the app. Reporting to 8080 gets skipped because "the matter is handled anyway" — and it is the only step on the list that protects anyone other than the person reporting.

How to protect your organisation

Smishing aimed at employees is awkward, because corporate controls usually stop at the work laptop while the message arrives on a phone the organisation cannot see. The controls below run from those that work regardless of anyone's awareness to those that build it.

One item on that list cannot be bought. Reports from people are the only source from which campaign-blocking patterns are built, and the only signal an organisation gets from a device it does not control. An awareness programme that penalises false alarms receives no reports after a few months, and loses the visibility along with them.

It is also worth remembering that SMS is one of several channels carrying the same social engineering, and separate training for each makes little sense. The same time pressure, the same request for a code and the same spoofed gateway appear in vishing with voice cloning and in QR code phishing. We cover every variant in our guide to types of phishing, and the wider picture of social engineering in finance in the Social Engineering Report 2026.

Frequently asked questions

Conclusion

Smishing works not because it is sophisticated. It works because it catches a moment of inattention on a device nobody protects, and because every layer of defence built for email disappears in this channel. Poland has more tools here than most countries: a statutory duty to block, CSIRT NASK patterns, a sender ID register and a free reporting number. All of that machinery shares one bottleneck, a report from a human being, and one boundary, the operator network. Beyond it, all that remains are decisions made on a small screen in a few seconds, and the only way to prepare those is to practise them.

Your firewall cannot see text messages. Your employees see all of them, and they are the ones deciding.