Phishing arrives by email, where a sender address, headers and a hoverable link can all be inspected. Smishing arrives by SMS or a messaging app, where there is no address to check and shortened links are normal, so the usual verification habits do not apply.
Email has decades of defensive tooling around it: gateways, SPF and DKIM checks, attachment sandboxing, and a visible sender address. SMS has almost none of that. It also lands on a personal phone, usually outside corporate filtering and outside the device management that protects a work laptop.
The behavioural difference matters as much. People read texts within minutes and reply on a small screen where a spoofed domain is harder to see.
Documented cases
- The nationwide toll-road smishing wave ran against E-ZPass, SunPass, PA Turnpike, MassDOT, NTTA and Peach Pass drivers, using a small unpaid-toll balance to make the demand feel trivial enough to just pay.
- A package-awaiting-action smishing kit impersonating USPS and UPS was documented in 2026, showing how industrialised the tooling has become.
- The Retool breach of 2023 cost $15M and is the clearest illustration of why SMS matters: it opened with a text message claiming a payroll problem, then escalated to a phone call using a cloned voice.
- For contrast, the Anthem breach exposed 78.8 million records at a cost of $260M and began with email phishing.
The control that breaks both
- Never act on a link in an unexpected message.
- Navigate to the organisation using a known address or app instead, which defeats the lure regardless of channel.
- Retool also demonstrated that one-time codes are interceptable, so phishing-resistant MFA using hardware keys is the control that survives both channels.
Related
Social Engineering Examples