13 real cases from this library, from the USPS and UPS package-notice kit and the toll-road text wave to boss-impersonation chats on WhatsApp and Teams. For each one: what the message said, what it cost, and what would have stopped it.
Smishing means phishing over text. Someone pretends to be a courier, a toll agency, a bank or your boss, and wants you to tap a link, reply or pay. These days it turns up on WhatsApp, LINE and Teams too, not just SMS, so this page covers both.
Key takeaways
Strip away the details and most cases here go the same way, in four steps.
The texts are cheap to send at scale. In the USPS and UPS "package awaiting action" operation, Censys researchers mapped 682 rotating look-alike hostnames behind one backend that streamed victims' card data to the operators in real time and even had a kill switch.
"Your package couldn't be delivered." "You owe an unpaid toll." These go to millions of people at once and only need a few to pay. The toll-road smishing wave copied E-ZPass, SunPass, the PA Turnpike and others. The FBI's 2024 report counts 59,271 toll-scam complaints and just $129,624 in reported losses. That loss number is far too low, because most people who handed over card data never filed a report.
A text "from IT" about an account problem, then a phone call. At Retool in 2023, that combination got an employee to give up one-time codes, and attackers took over 27 crypto customer accounts.
A message that looks like it's from the CEO, asking for an urgent, confidential transfer. A Pune CFO wired Rs 56 lakh after a Teams message using her Italian CEO's name and photo. In a separate Indian case, fraudsters posed as a former MP on WhatsApp, using his real display photo, and got his company's finance staff to push through Rs 7.68 crore in four transfers.
An unsolicited text offers easy online work: rate products, "complete tasks," earn commission. Then the job asks you to deposit money to unlock your earnings. Task-scam reports went from about 5,000 in 2023 to an estimated 20,000 in the first half of 2024 alone, per the FTC.
The slowest version. A stranger texts, gets chatty, builds a relationship over weeks, then introduces a crypto "opportunity" on a fake platform. Six of the 13 cases here are this kind, including the largest single loss in the group. See pig butchering.
Loss figures keep the basis stated on each case page. They're measured, reported or alleged in different ways, so don't add them up.
| Case | The hook | What it cost |
|---|---|---|
| Toll-road smishing wave, 2024 to 2025 | "Unpaid toll" texts spoofing state toll agencies | 59,271 complaints to IC3 in 2024; FBI Atlanta logged 1,573 Peach Pass complaints in the first twelve days of March 2025 |
| USPS/UPS package kit, 2026 | "Package awaiting action" | Not quantified; 682 look-alike hostnames mapped |
| Retool, 2023 | A text from "IT" about health-plan enrollment, then a call | 27 customer accounts taken over and reverted; a downstream customer estimated about $15 million in crypto losses |
| Pune CFO, 2026 | Teams message as the CEO | Rs 56 lakh sent; a second Rs 1.5 crore demand failed when she called the real CEO |
| Former MP's company, 2026 | WhatsApp messages using the owner's real photo | Rs 7.68 crore sent; Rs 4.28 crore later held by banks |
| Heartland Tri-State Bank, 2023 | WhatsApp contact that became a crypto "investment" | $47.1 million of bank funds wired by the CEO; the bank failed |
| Spoofed SIMEX domains, 2022 | Dating apps and messaging, then a fake trading app | Over $10 million across five victims; one started with $400 and sent about $9.6 million |
| Austin DAIQ scam, 2026 | LINE chats and a fake crypto platform | $1,408,850 lost over six months |
| FTC task-scam data, 2024 | Unsolicited job texts | $223 million in reported job-scam losses in the first half of 2024 |
The full list of 13 is further down this page, with filters for status and country.
| Stage | What helps | Case it would have broken |
|---|---|---|
| The hook | Treat any payment request that arrives as a text link as suspect, and tell staff and family the same | Toll wave, USPS kit |
| The link | Don't tap. Go to the real site or app yourself | Toll wave, USPS kit |
| The harvest | Phishing-resistant MFA, so a typed code is useless on a fake page | Retool |
| The transfer | Call the person back on a number you already have before any urgent payment | Pune CFO, former MP's company |
| The cash-out | Banks and exchanges questioning large first-time crypto transfers | Heartland, SIMEX domains |
The Pune case shows the cheapest control working. The first transfer went through. The second demand, the next morning, is where it fell apart: the CFO picked up the phone and called the real CEO.
Mainly, the channel. Phishing usually means email. Smishing is the same idea by text or messaging app. Vishing is a phone call. Plenty of real attacks use more than one. Retool's attacker texted first and then called, and the Pune boss scam ran entirely through a chat app. For a closer look, see smishing vs phishing.
It's phishing that arrives as a text, or more and more often as a WhatsApp, LINE or Teams message. SMS plus phishing, hence the name. What the scammer wants hasn't changed from email: a tap, your card or login details, or a payment.
Usually short and ordinary. A delivery that needs a fee, a toll you supposedly didn't pay, a bank alert, a job offer, or a "wrong number" message from a friendly stranger. The toll-road texts in this library asked for small sums so people would pay without thinking twice.
If you entered card details, call your bank on the number on your card and ask them to block it. If you entered a password, change it from a device you trust and turn on stronger MFA. If money went out, report it to your bank straight away and file with the FBI's IC3 or your local equivalent.
In the US and UK, most mobile carriers accept forwarded spam texts at 7726. You can also report scam texts to the FTC in the US. Reports matter: the FBI's toll-scam alerts were built from exactly those complaints.
Not quite. Pig butchering often starts with a text, so it overlaps, but it's a long con that builds trust over weeks before any money moves. Most smishing is quick and transactional. Six of the 13 smishing cases here are pig-butchering scams.
Counts on this page come from the 13 cases tagged smishing in this library on 21 Oct 2026. The library statistics page has the wider picture. Reviewed by SEE Team. Last reviewed 21 Oct 2026. See the methodology, or who publishes this library.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC won a $5.5M default judgment.
SMCensys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
SMTexts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025. How the scam works and how to check a toll text.
SMDubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters. What is known.
SMA Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs 1.5 crore request made her call the real CEO. What happened.
SMA fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the rest: 27 crypto accounts hijacked. What happened.
SMFraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in transfers on WhatsApp. How it worked.
SMA respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11 transfers and collapsed the bank. Why dual control didn't save it.
SMTask scams start with a job text and end with crypto deposits to unlock fake earnings. FTC: reports rose from 5,000 to 20,000; $223M lost in six months.
SMIn June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.
SMUS prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash. How the refund trick works.
SMAn Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police to a 34-year-old courier. How it worked.
Social Engineering Examples