July 10, 202610 min read

Smishing in the Enterprise: How SMS Phishing Bypasses Email Defenses and What to Do About It

Sources:Proofpoint 2025 State of the Phish|Lookout Mobile Phishing Report 2025|FBI IC3 2025 Internet Crime Report

Eric Bang

Founder & Cybersecurity Evangelist

higher click-through rate on SMS phishing links versus email phishing links — mobile users are conditioned to tap, not scrutinize

76%

of organizations experienced smishing attacks targeting employees in 2025 — Proofpoint State of the Phish

$2.9B

in BEC and related social engineering losses reported to the FBI in 2025 — SMS-initiated attacks are an increasing share

email security gateways, DMARC policies, or anti-spam filters that apply to SMS messages — the channel is unguarded by default

Current enterprise smishing attack patterns

Knowing the specific templates attackers use makes it easier to build relevant user training.

IT helpdesk and VPN impersonation

Messages impersonating your IT department: 'Your Cisco AnyConnect VPN access has been suspended due to policy violation. Verify your identity to restore access: [link].' The link leads to a credential harvesting page styled to match your corporate SSO login portal. This pattern exploits VPN awareness post-COVID — employees know VPN disruptions happen and have been trained to resolve them quickly.

HR and payroll platform spoofing

'Action required: Your 2026 tax withholding form has not been submitted. Failure to complete by Friday will delay payroll. Submit now: [link].' HR-related texts exploit urgency and the fact that employees legitimately receive important communications from payroll and HR systems. These attacks often target corporate phone numbers harvested from LinkedIn or company directories.

Executive impersonation and gift card fraud

Texts appearing to come from a C-suite executive — 'Hi, this is [CEO name]. I'm in a meeting and need your help. Can you purchase $500 in Amazon gift cards and text me the codes? I'll reimburse you.' This pattern, known as gift card fraud, is low-tech but effective because it exploits the employee's desire to be helpful to leadership and the perceived urgency of an executive request.

QR code-embedded smishing

Texts containing QR codes that link to malicious sites are increasingly common because QR codes are harder to analyze before scanning. A text stating 'Scan to verify your identity for building access' or 'Scan to confirm your COVID health attestation' routes the employee's phone browser to a credential phishing page. QR codes bypassed email security filters for years; they work the same way in SMS.

Callback / vishing hybrid

A text asking the recipient to call a number: 'We detected suspicious activity on your account. Call our security team immediately at [number].' When the employee calls, they reach a fake IT support agent who walks them through 'verifying their identity' — in reality collecting credentials or directing them to install a remote access tool.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Why standard controls don't apply to SMS

Before covering what works, it's worth being precise about what does not work for SMS threats.

Email security tools don't touch SMS

Your Proofpoint, Mimecast, or Microsoft Defender for Office 365 deployment provides zero protection against SMS phishing. DMARC, DKIM, and SPF authenticate email senders — they have no SMS equivalent. URL sandboxing in email gateways does not scan links received via SMS. Any investment in email security has no lateral benefit for smishing defense.

Mobile numbers are harder to protect than email domains

Attackers can spoof sender IDs in many SMS systems, making messages appear to come from recognizable names or short codes. Unlike email where DMARC can prevent spoofing of your domain, there is no equivalent SMS authentication standard with broad enforcement. Mobile carriers have deployed some sender verification for A2P (application-to-person) messaging, but attacker-controlled SIM cards and SMS aggregators can still deliver spoofed messages.

BYOD environments have no security visibility on personal devices

In BYOD environments where employees use personal phones for corporate work, your MDM does not have visibility into SMS messages received on the personal partition or personal device. There is no feasible technical control to inspect all SMS messages received by employees.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Controls that reduce smishing exposure

Despite the channel limitations, a layered approach reduces smishing success rates significantly.

Deploy Mobile Threat Defense (MTD) for corporate-enrolled devices

Mobile Threat Defense products (Lookout, Zimperium, Microsoft Defender for Endpoint mobile) install on enrolled mobile devices and provide SMS phishing link detection — analyzing URLs in messages against threat intelligence feeds and blocking access to known malicious pages. For devices enrolled in your MDM (corporate-issued or BYOD corporate partition), MTD is the closest equivalent to an email gateway for the SMS channel.

Publish clear channel policies for IT and HR communications

Establish and communicate a formal policy: IT will never send IT security alerts or credential verification requests via SMS. HR will never request action on benefits, payroll, or compliance matters via SMS alone without a corresponding in-portal notification. This gives employees a clear framework for evaluating unexpected SMS messages claiming to be from internal departments — if the channel isn't used, the text is immediately suspicious.

Run SMS-specific phishing simulations

Most phishing simulation platforms (KnowBe4, Proofpoint Security Awareness, Cofense) now support SMS simulation campaigns. Run dedicated smishing simulations separate from your email phishing program — the click rates will be different and the training reinforcement must specifically address the SMS context. Users who have been trained to scrutinize email links have not necessarily transferred that scrutiny to SMS.

Use number-verified communication channels for critical internal alerts

For security-sensitive internal communications (VPN access changes, MFA resets, account security alerts), use in-app notifications in your corporate apps (Teams, Slack, ServiceNow) rather than SMS. These channels authenticate the sender by definition — the message appears inside the authenticated corporate application, not as a spoofable SMS from an unknown number. If SMS must be used for corporate alerts, use a registered short code that employees can verify in advance.

Add SMS awareness to security training explicitly

Most security awareness curricula are heavily email-centric. Add a dedicated smishing module that covers: the visual difference between SMS and email, why URLs in SMS are harder to inspect on mobile browsers, the common impersonation templates (IT, HR, executive, package delivery), and the correct response (do not click — contact the sender through a known channel to verify). Specific SMS examples outperform generic 'social engineering awareness' for reducing smishing click rates.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Incident response when an employee clicks a smishing link

When an employee reports clicking a suspicious SMS link or entering credentials on a linked page, the response must move quickly because smishing victims often don't report immediately.

Assess what was submitted on the phishing page

Ask the employee: what information did they enter on the page? Credentials only? MFA code? Did they install anything from the page? The response differs for each: credentials only (reset the password, revoke sessions); credentials plus MFA code (treat as potentially active compromise — AiTM interception may have granted access already); installation of any software (isolate the device and escalate to malware investigation).

Revoke sessions and reset credentials immediately

For any credential submission, treat it as a confirmed credential compromise: revoke all active sessions for the affected account in your IdP, force a password reset from a clean device (not the device that received the smishing message, which may still be compromised), and monitor the account for suspicious activity for 30 days after the incident.

Report malicious SMS numbers to carriers and authorities

Report smishing messages targeting your organization to: your mobile carriers (they can flag and block the source number), the Anti-Phishing Working Group (reportphishing@apwg.org), and the FTC/FCC at reportfraud.ftc.gov. For coordinated smishing campaigns targeting your organization's employees specifically, report to the FBI IC3. Carrier-level blocking reduces continued exposure for your employee population.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

Smishing is the fastest-growing social engineering vector for enterprises in 2026 because the defense gap is wide and attackers know it. Your email security investment provides zero protection against SMS phishing. The practical controls — MTD on enrolled devices, clear channel policies, SMS-specific training, and verified in-app channels for security communications — close a significant fraction of the gap without requiring new enterprise platform purchases.

Frequently asked questions

What is the difference between smishing and vishing?

Smishing is phishing via SMS text message. Vishing is phishing via voice call. Both bypass email security controls. They are often combined — a smishing text asks the recipient to call a number, connecting to a vishing actor who completes the social engineering. The Scattered Spider group used this combination extensively in their 2023-2026 enterprise breaches.

Can mobile carriers block smishing attacks?

Mobile carriers in the US have deployed anti-spam filtering for SMS at the network level and have A2P (application-to-person) messaging regulations that require business senders to register. However, attacker-controlled SIM cards, grey-route SMS aggregators, and international messaging gateways allow sophisticated attackers to bypass many carrier-level controls. Carrier filtering reduces commodity smishing volume but does not stop targeted enterprise smishing campaigns.

Are QR codes in SMS more dangerous than regular links?

QR codes in SMS are more dangerous from an analysis perspective because mobile users typically cannot see the destination URL before scanning, mobile browsers don't show full URLs prominently, and QR codes bypass simple URL inspection training ('look before you click' advice doesn't apply when the URL isn't visible). Train employees to treat any unsolicited QR code in SMS with the same skepticism as an unexpected link.

Sources & references

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

smishing enterprise SMS phishing corporate smishing attack 2026 text message phishing mobile phishing enterprise BYOD smishing SMS social engineering smishing defense controls

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Smishing in the Enterprise: How SMS Phishing Bypasses Email Defenses and What to Do About It

Current enterprise smishing attack patterns

Why standard controls don't apply to SMS

Controls that reduce smishing exposure

Incident response when an employee clicks a smishing link

The bottom line

Frequently asked questions

What is the difference between smishing and vishing?

Can mobile carriers block smishing attacks?

Are QR codes in SMS more dangerous than regular links?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway