What Is Smishing and Phishing, in Plain Words

Smishing is phishing that arrives by text. Here is what each one is, the tricks they share, and what to do when a message looks wrong.

What phishing is

Phishing is a trap sent to you as a message. The FBI says phishing emails are built to steal your personally identifiable information or your financial credentials. That means your username, your password, your card number, or details like your Social Security number.

The FTC says scammers send phishing emails to trick you into giving them your personal information. The email looks like it came from a company or agency you trust. It did not.

The FBI says phishing schemes often rely on spoofing techniques to draw you in and get you to act. Spoofing means the message is dressed up to look real. The sender name, the logo, even the web address can be faked.

If you got an email about your Social Security account, read about the social security scam email and how it works.

What smishing is

Smishing is the same scam, sent by text. The FBI says smishing uses SMS text messages instead of email. The Postal Inspection Service says smishing is a form of phishing that uses a text message or phone number.

The FTC says scammers send fake text messages to trick you into giving them your personal information. The Postal Inspection Service says smishing victims get a deceptive text meant to lure them into giving personal or financial information.

One well known example is a text that claims a package is waiting. The Postal Inspection Service says a text message claiming a USPS delivery needs a response, with a strange link, is a scam called smishing. Our page on the smishing scam covers that one in detail.

How smishing and phishing differ

The difference is the channel. Phishing comes by email. Smishing comes by text. The FBI also describes vishing, which uses phone calls, generally with an automated voice. Same goal, different delivery.

The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust.

Whether it lands in your inbox or your text app, the playbook is the same.

They pretend to be someone you trust. The FBI says scammers typically pose as a creditor, bank, or state benefits agency. The Postal Inspection Service says smishing scammers often pretend to be a government agency, bank, or other company to seem legitimate.

They push you to a fake site. The FBI says fake websites used in phishing are made solely to steal your information. The link in the message leads to a page that looks like the real company's login screen. It is not.

They ask for what a real company would never ask for. The FBI says companies generally do not contact you to ask for your username or password. The Postal Inspection Service says legitimate companies will not ask you to confirm or provide personal information.

They want your details for a reason. The Postal Inspection Service says scammers want usernames, passwords, Social Security numbers, birth dates, and card numbers. Stolen personal information is then used to carry out other crimes, such as financial fraud. Your details are the product.

If a message asks for cryptocurrency, read about the crypto scam before you send anything.

Warning signs in a message

Here is what to look for before you tap or click anything.

Spelling and grammar problems. PayPal says typos, misspellings, and incorrect grammar are common in phishing messages.
A near miss in the address. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye.
A request for personal information. The Postal Inspection Service says to verify the sender's identity and ask yourself why the sender wants your information.
An attachment you did not expect. The FBI says never to open an email attachment from someone you don't know, and to be wary of attachments forwarded to you. PayPal says attachments can contain malware, so you should never open them unless you are completely sure they are legitimate.

Do not lean on the padlock icon either. PayPal says many fake sites show a padlock symbol in the address bar, so you should not rely on it. It also says the letter s in https does not always mean a site is legitimate, because hackers can build encrypted sites too.

What to do when a message looks wrong

The FBI says not to click on anything in an unsolicited email or text message. That is the whole rule. That means no tapping the link, no opening the attachment, and no answering the message.

Instead, check on your own. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. Take the number from your card, a bill, or the company's own site. Not the one in the message.

If you already clicked or typed something, act fast. The Postal Inspection Service says that if you already interacted with the link, even without clicking submit, you should notify your financial institution.

Then add a lock on your logins. The FBI says to set up two-factor or multi-factor authentication on any account that allows it, and never disable it.

One more thing. PayPal says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal. The name on the screen proves nothing.

How to report smishing and phishing

Here is where each kind goes.

To the FBI. The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.
USPS package texts. The Postal Inspection Service says to report USPS related smishing by emailing spam@uspis.gov.
By forwarding the text. The Postal Inspection Service says to forward the smishing text message to 7726 to help report the scam phone number.
Other smishing. The Postal Inspection Service says non-USPS smishing complaints can go to the Federal Trade Commission. It says the FBI's Internet Crime Complaint Center takes those complaints as well.

The Postal Inspection Service also says to regularly check your cell phone bill for unauthorized charges and report them to your carrier.

PayPal puts the plan simply. It says the best way to stay secure is to detect, avoid, and report. Learn the signs, skip the link, and pass the message along to the people who hunt these scams.