Smishing: A form of phishing delivered by SMS or text message, in which a fake sender persuades the recipient to click a link, call a number, reveal information or share a verification code.
Also known as: SMS phishing, Text message phishing
Key takeaways
- Smishing is phishing by text message, usually with a short link or a callback number.
- Common lures: package delivery, bank alerts, toll or fine payments, and fake colleagues.
- Texts asking you to forward a verification code are a red flag every time.
- Sender names can be spoofed, so a familiar sender doesn't prove a text is genuine.
- C Chat sends sign-in codes by SMS; nobody legitimate will ever need you to share them.
Text messages have a high open rate and almost everyone reads them right away. That is exactly why attackers like them. For businesses with frontline staff who live on their phones and rarely check email, smishing is often a bigger risk than email phishing.
Smishing: a plain definition
Smishing is phishing squeezed into a text message. The format forces brevity, so smishing messages tend to rely on a single emotional trigger and a single action: tap here, call this number, reply with this code.
How it works
A typical smishing attack has three parts:
- A believable sender. The text appears to come from a delivery company, bank, toll authority, mobile carrier or employer. Sender names can be spoofed so the text lands in the same thread as genuine messages.
- A short, urgent hook. “Your package is on hold”, “Unusual sign-in detected”, “Unpaid toll, fine due today”, “Hi, it’s your manager, new number”.
- A low-effort action. A shortened link to a fake page, a phone number staffed by scammers, or a request to reply with a code you just received.
Common smishing lures at work
| Lure | What the attacker wants |
|---|---|
| “New number, it’s your boss” | Gift cards, payments or confidential files |
| “Your work account is locked” | Credentials typed into a fake page |
| “Forward the code I just sent you” | A one-time code to take over your account |
| Delivery or payroll notice | Card details or personal data |
Why it matters for business messaging
Many messaging apps, including C Chat, use SMS codes for sign-in. That makes text messages part of the login chain. A smishing attack that persuades someone to forward their code can lead directly to an account takeover, after which the attacker can message colleagues and clients under that person’s name.
Smishing also pairs with other attacks. An attacker who wants to redirect SMS entirely may try a SIM swap instead, often after gathering personal details through social engineering.
How it relates to C Chat
When you sign up or log in to C Chat with your phone number, you receive a one-time code by SMS. You can also sign in with email and receive the code there. In either case, the code is meant only for you, typed into getcchat.com/c or the app.
A few rules for your team:
- Never forward or read out a C Chat code, even to a colleague, manager or someone claiming to be support.
- Only type the code into C Chat itself, never into a page reached from a link in a text.
- Treat unexpected codes as a warning. It means someone tried to log in with your number. Tell your team admin.
- Block and report impostors. If someone in C Chat asks for a code, use block and report.
The trade-offs of code-based login are explained in passwordless sign-up. For a training-ready checklist, share how to spot phishing in chat apps and mobile security basics for staff phones with your team.
Related terms and common misconceptions
- “Texts from known senders are safe.” Sender IDs can be spoofed; verify through the official app or website.
- “Smishing only targets individuals.” Attackers increasingly impersonate employers and managers to reach company accounts and money.
- “Android and iPhone filters catch everything.” Filters help but miss targeted messages.
Getting started
Give your team a work channel where colleagues are known team members instead of unknown numbers: create a team at getcchat.com/c and invite staff directly by link or QR code. More on protections is on the security page.
Frequently asked questions
How do I recognize a smishing text?
Look for urgency ("today", "final notice"), a shortened or unfamiliar link, requests for payment or personal details, poor grammar, and messages about services you don't use. A real company will let you resolve the issue by going to its official app or website directly.
What happens if I tap a smishing link?
Often it opens a fake page that asks for card details, a password or a code. If you entered nothing, close it and delete the message. If you entered data, contact your bank or the real service immediately and change any credentials you typed.
Should I reply STOP to a smishing text?
It's best not to reply at all. Any reply confirms your number is active. Report the message using your phone's built-in reporting option or your carrier's spam reporting service, then delete it.
Why do scammers ask me to forward a code?
Because they have just requested a login or a SIM change using your number, and the code is the last thing they need. Forwarding it hands them your account. Treat any request to share a code as an attack.