SMS Has a Trust Problem: Why Smishing Works So Well

Smishing succeeds not only because criminals send convincing messages, but because legitimate organisations have trained customers to treat SMS as a normal channel for security, marketing and account activity.

Original article date: 23 February 2024

Article type: Security commentary

Executive summary

SMS is universal, familiar and convenient. Those same qualities make it attractive to attackers.

Banks, insurers, retailers, government services and other organisations routinely use SMS for notifications, marketing and authentication. Criminals can exploit that familiarity by sending messages that imitate the same style and create the same sense of urgency.

The resulting problem is larger than "people should not click suspicious links." The ecosystem itself often makes legitimate and malicious messages difficult for ordinary users to distinguish.

Why smishing is effective

A typical smishing message does not need to be technically sophisticated. It only needs to arrive at the right moment with a believable story:

• a parcel is waiting;

• a bank account requires verification;

• a tax payment is overdue;

• a card has been blocked;

• a subscription is expiring; or

• a security event needs immediate attention.

The attacker benefits from a communication environment in which legitimate businesses already send short messages, shortened links, branded sender names and urgent requests.

That creates a trust problem.

Legitimate organisations shape user behaviour

Security advice often focuses entirely on the recipient: do not click, check the link, recognise the scam.

But organisations also influence behaviour.

If a bank sends both security notifications and marketing messages through SMS, users learn that SMS is a normal bank interaction channel. If a legitimate company asks customers to click an opaque link to manage preferences, it becomes harder to tell a real message from a fraudulent one.

Every legitimate message establishes a pattern that an attacker can copy.

This is why communication design is part of security design.

What I observed in my own SMS history

When I reviewed messages received over an extended period, several recurring patterns stood out:

• Many marketing messages provided poor or inconsistent opt-out mechanisms.

• Some organisations used links that gave the recipient little information about the destination.

• Financial-services brands mixed commercial communication with security-related messaging.

• Some messages contained personal information that should be handled cautiously.

• Phishing messages sometimes contained enough personal information to appear credible, which may indicate data obtained from previous leaks, compromised marketing lists or other sources.

• Legitimate and fraudulent messages were often visually similar.

The important conclusion is not that every SMS is fraudulent. It is that SMS by itself provides weak assurance about who is communicating with you.

Authentication and communication are different problems

SMS can still have value as a delivery mechanism in some environments, but it should not be treated as proof of identity.

A security-sensitive interaction should move into a channel where the user can verify the organisation independently.

For example:

• A bank can send a notification saying, "Open the banking app to review a security alert," without including a login link.

• A customer can navigate to the official application or website independently.

• High-risk actions can be confirmed inside the authenticated session with clear transaction details.

This separates notification from authentication.

Why SMS-based one-time codes need careful design

One-time codes delivered by SMS can improve security compared with passwords alone, but they also have limitations. Attackers can combine phishing with social engineering, SIM-related attacks or real-time credential capture.

The larger design mistake is allowing users to believe that possession of an SMS proves that the message itself is trustworthy.

Where stronger authentication methods are available and practical, organisations should consider them. More importantly, authentication messages should clearly state what action is being authorised so users are less likely to approve something they did not initiate.

What organisations should change

1. Stop putting login links in security-sensitive SMS messages

Tell the customer what happened and instruct them to open the official application or navigate to the known website themselves.

2. Separate marketing from security communication

Do not use the same tone and channel for sales promotions and urgent security events.

3. Make authentication messages explicit

A message should explain the specific action being authorised: amount, merchant, device, payee or other meaningful context where appropriate.

4. Provide a verifiable reporting channel

Customers need an easy way to report suspicious messages without replying to the attacker.

5. Reduce unnecessary personal information

Do not place sensitive information into an unauthenticated communication channel unless there is a clear need and appropriate protection.

6. Treat brand impersonation as a security incident

Organisations should monitor for phishing campaigns that abuse their brand and should have a documented process for reporting malicious domains and infrastructure.

What users can do

• Treat unexpected urgency as a warning sign.

• Do not rely on the sender name as proof of origin.

• Avoid logging in through links in unsolicited security messages.

• Open the organisation's official application or website independently.

• Never disclose passwords or authentication codes to someone who calls you.

• Read authentication prompts carefully before approving anything.

• Report suspicious messages through the organisation's official channel.

The wider issue

Smishing is not simply a failure of user awareness. It is a systems problem involving organisations, telecom providers, messaging platforms, regulators, security teams and end users.

The more legitimate businesses train customers to treat unauthenticated SMS as a normal place to conduct sensitive business, the easier it becomes for attackers to imitate them.

Conclusion

SMS is useful as a notification mechanism. It is much less useful as an identity mechanism.

The safest design principle is therefore:

Use SMS to tell the customer that something requires attention. Use an independently authenticated channel to perform the sensitive action.

That small change makes the attacker's job considerably harder.