Smishing

A form of phishing conducted through a text message rather than email, in which an attacker sends a fraudulent SMS or messaging-app text, typically impersonating a bank, delivery company, government agency or other trusted organization, in an attempt to trick the recipient into clicking a malicious link, downloading malware, or disclosing sensitive information such as a password, bank account number or one-time authentication code. The term is a portmanteau of SMS and phishing, and cybersecurity researchers and law enforcement agencies, including the United States Federal Bureau of Investigation, have documented a substantial rise in smishing volume in step with the broader shift of everyday communication and commerce onto mobile devices, with attackers frequently exploiting the smaller screen and abbreviated link display of a mobile text message to make a fraudulent link harder for a recipient to scrutinize than the equivalent link would be in a desktop email client. Smishing is prosecuted under the same wire fraud, identity theft and computer fraud statutes generally used to prosecute email phishing, since the underlying deceptive and technology-enabled conduct is substantially the same.