Smishing vs phishing boils down to text versus email. A phishing message turns up in your inbox, while smishing comes to your phone as an SMS or a WhatsApp-style chat. Underneath it’s the same con, though. You’re meant to tap the link and give away a password, your card details or a one-time code.
The channel changes more than you’d think, though. An email can be filtered, inspected and reported before you act. A text usually reaches you directly, on a small screen, on a phone your employer may not manage at all.
| Phishing (email) | Smishing (text) | |
|---|---|---|
| How it arrives | An email | An SMS, iMessage, WhatsApp or similar |
| What you can check | Sender address, headers, the real link behind the text | A phone number or short code, and a link that’s often shortened |
| Filtering | Usually passes through a company email gateway first | Mostly carrier spam blocking, if anything |
| The usual story | An account notice, an invoice, a shared file | An unpaid toll, a parcel on hold, a bank alert, a payroll problem |
| A case from this library | Anthem (2014 to 2015): one opened email, data on 78.8 million people stolen | Toll-road texts (2024 to 2025): more than 2,000 FBI complaints in about five weeks |
| What stops it | Filters, link checks, phishing-resistant MFA | Don’t tap. Open the app or type the address yourself |
Key takeaways
Most people have had years of practice with dodgy emails. You learn to hover over a link, squint at a sender address, notice that “PayPal” is writing from a Gmail account. Work email adds a gateway that strips out plenty before it reaches you.
Texts skip most of that. There’s no sender address to read, just a number. Shortened links are normal, so a weird one doesn’t stand out. And a text feels personal and urgent in a way an email rarely does. A small toll balance or a parcel waiting for a fee doesn’t seem worth a second thought.
In April 2024 the FBI’s Internet Crime Complaint Center said it had received more than 2,000 complaints since early March about texts claiming an unpaid toll. The message quoted a small balance, $12.51, and threatened a $50.00 late fee. The link led to a fake payment page dressed up as a state toll service. The wave kept coming back through 2025, across about eight states. Full case: toll-road smishing wave.
Researchers at Censys mapped one parcel-scam operation and found 682 look-alike hostnames rotating behind it. The fake pages sent card details back to the operators in real time, keystroke by keystroke, before the victim even pressed submit. Full case: USPS and UPS smishing kit.
Several Retool employees got a text from someone posing as IT, saying their payroll system was out of sync ahead of open enrollment. One person followed the link and entered a login and a one-time code. A phone call followed, and in the end attackers took over 27 customer accounts. Retool’s claim that the caller used a deepfaked voice was never backed with evidence, and the roughly $15 million crypto loss linked to the breach was disclosed by a customer, not by Retool. Full case: Retool smishing and vishing breach.
In February 2014 an employee at an Anthem subsidiary opened a spear-phishing email. That one click seeded an intrusion that went on quietly for about 11 months and ended with personal data on roughly 78.8 million people stolen. It’s a reminder that email filters don’t catch everything, even at a large company. Full case: Anthem breach.
Tip: look at what the message wants. Tap this link, pay this small amount, confirm this code? Whether it came by text or email, close it and go to the company’s app or a website you type in yourself.
There are more examples in the smishing case collection, and plenty more on the email side in the phishing cases.
Yes. Think of phishing as the family name. Smishing is the branch that uses text messages, and when it’s done over a phone call it’s called vishing; see vishing vs smishing.
It depends on the situation. Emails reach more people at work and have caused the larger breaches in this library. Texts are more likely to reach someone with no filter in the way, and people act on them faster. At a company, smishing is often the route around email security that already works.
Not really. Carriers block some known scam numbers, and managed work phones can add protection. Personal phones are mostly outside a company’s control. That’s why the defense leans on habits and on MFA that can’t be phished.
If you entered nothing, close the page. If you typed in a password, change it on the real site straight away. If you entered card details, call your bank on the number on your card. At work, tell your security team, because a stolen login can be used within minutes.
No. Some ask you to reply or to call a number, which turns the scam into a phone call. The vishing vs smishing page covers how those handoffs work.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. Each case link goes to the full write-up, sources included. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples