Text message scams

Smishing awareness training for the texts nobody expects.

Smishing is phishing by text message. Texts feel personal and urgent, and a phone screen hides what a link really is. Training helps people pause before they tap.

Protect my team Browse the modules
Self-paced modules you buy once. Instant access after purchase.
text message
FromUnknown sender
MsgYour package is on hold. Confirm your address to release it.
Tap to confirm: pkg-track.example/confirm
Deleted and reported without tapping
Illustrative example
how it works
How it works

What smishing is and why people tap

Smishing combines SMS and phishing. A text claims to be a delivery notice, a bank alert, a toll or account problem, or a message from a coworker, and asks you to tap a link, call a number, or reply with a code.

It works because text messages feel immediate and personal, they arrive on a device people carry everywhere, and a small screen makes a link hard to inspect. Many people also use personal phones for work, so a text can reach a work account through the back door.

warning signs
Warning signs

Warning signs of a smishing text

A text can be real and still show one of these. Use them as a prompt to check through the official app or website instead.

  • A message from a number you do not knowDelivery, banking, and account alerts from unfamiliar numbers or odd short codes deserve extra care.
  • A shortened or odd-looking linkShort links hide the destination, and look-alike domains imitate real brands.
  • Urgency or a threatA package on hold, an account locked, or a fee about to apply is designed to rush you.
  • A request for a verification codeAnyone asking you to read back or reply with a one-time code may be trying to take over an account.
  • A message about something you did not doA package you never ordered, or a payment you did not make, is a common hook.
in the moment
In the moment

What to do when a suspicious text arrives

The safest move is to leave the text alone and check the claim somewhere you trust.

  1. Do not tap or replyLeave the link alone and do not answer, even to say stop.
  2. Go to the source yourselfOpen the official app or type the website address yourself to check any claim.
  3. Never share a one-time codeA real organization will not ask you to read a verification code back to them.
  4. Report and deleteUse your phone's report junk option or your organization's reporting route, then delete the message.
  5. If you tapped, act quicklyTell your IT or security contact, change any password you entered, and watch for unusual account activity.
The training

Smishing awareness training that goes beyond the inbox

These AwarenessCORE modules are self-paced and each ends with a graded assessment.

Phishing AwarenessCovers attacks that arrive by text, phone, QR code, and fake MFA prompts.The psychology attackers use, reading an email like an attacker, attacks that arrive by text, phone, QR code, and fake MFA prompts, targeted fraud such as business email compromise, and how to verify, report, and recover.View module and price ›Security Awareness EssentialsAdds device safety and working safely anywhere.Core security habits: the human layer, social engineering beyond phishing, accounts, passwords and MFA, devices and workspace, working safely anywhere, and policies, reporting, and culture.View module and price ›

Browse all modules and prices

A dedicated module on this topic is coming soon. See the Coming soon card.

Questions teams ask

Questions about smishing awareness training

What is smishing?

Smishing is phishing carried out over SMS or other text messaging. The message tries to get you to tap a link, call a number, or share information such as a password or one-time code.

What is the difference between phishing and smishing?

The tactic is the same, but the channel differs. Smishing arrives by text, where messages feel more personal, links are harder to inspect, and email filters do not apply.

Why do scammers ask for verification codes?

A one-time code often confirms a login. If a scammer is trying to sign in to your account, they need the code sent to your phone, so they ask you to read it back. Never share a code with anyone who contacts you first.

Do personal phones matter for work security?

Yes. Many people receive work messages, approve sign-in prompts, or use work apps on personal phones, so a smishing text can become a route into work accounts.

What should employees do with a suspicious text?

Do not tap links or reply. Check the claim through the official app or website, report the message using your organization's route or your phone's report option, and delete it.

Know the signs

Know the signs beyond smishing

A quick reference: the first warning sign from each of the ten threat pages. Each chip opens the full list and what to do.

PhishingThe sender and the address do not matchCEO fraudA request to pay, transfer, or buy gift cardsFake invoice scamsChanged bank detailsSmishingA message from a number you do not knowSocial engineeringA caller who creates urgencyRansomwareAn unexpected attachment or downloadInsider threatsData shared more widely than neededPassword securityThe same password in many placesWire fraudNew or changed payment instructionsAccount takeoverVerification prompts you did not start

Get smishing awareness training for your team

Tell us your team size and we will suggest which modules fit. A real person replies, usually within one business day.

  • A real person, not a bot, within one business day
  • Straight answer on cost and what fits your team size
  • No pressure to buy

Get a callback

Tell us about your team and we will follow up.
Rather move now? Browse the modules ›

Got it. We will be in touch.

Someone from AwarenessCORE will reach out within one business day.

What every module includes

  • A graded knowledge check with a pass mark
  • A completion certificate when you pass
  • Access that does not expire
  • One payment per module, no subscription

Built by TheBRHub, an IT and email security company in Carlsbad, California.

Train your team to spot scam textsGet started