Definition
Smishing—a portmanteau of SMS and phishing—is a cyber scam that lures victims into tapping web links sent via text message to steal their financial credentials or personal information. Disguised as routine alerts such as package delivery notices or wedding invitations, these messages fool users into entering credentials on fake websites or trick them into installing malicious apps that secretly siphon money from their accounts.
A Phisher Disguised as a Delivery Driver
When you get a text claiming a package has arrived at your door, your natural reaction is to check it right away. Scammers prey on this exact sense of urgency and curiosity.
They cleverly disguise their texts as everyday notices: mobile wedding invitations, unpaid traffic tickets, or medical checkup results. The unmistakable trademark of these deceptive messages is a blue, shortened web link placed at the very end.
To give victims no time to second-guess, scammers use alarming phrases like 'Package returned due to address error' or 'Verify unpaid traffic fine immediately.' In the rush of daily life, tapping that link out of anxiety or curiosity hooks you right on the scammer's invisible fishing line.
What Happens Inside Your Phone After the Tap
Tapping the link opens a counterfeit webpage that looks shockingly identical to a real bank or popular web portal. From there, it prompts you to enter your login credentials or download an installer file packed with malware.
If a user falls for the trap, installs the file, and approves the requested permissions, the attacker gains remote control access within the boundaries of those granted privileges. They can covertly monitor your screen, browse your call logs, and rifle through your contacts and photos.
Worst of all, attackers can intercept incoming text messages containing one-time passwords (OTPs) and bank verification codes. Operating entirely behind your back, scammers can apply for loans or wire funds out of your account. Before you even realize what happened, your bank balance vanishes, or unauthorized mobile billing charges max out your limit.
Going Deeper: The Truly Fatal Moment
Many people assume that simply tapping the link instantly drains their bank account, but the real danger lies in installing the malicious app and granting it permissions. Modern smartphones feature built-in defenses that automatically block unauthorized software downloaded outside official app stores.
To bypass this shield, scammers deceive users with prompts like 'Security update required' or 'Install our dedicated viewer to track your delivery.' The moment a user manually toggles on install from unknown sources and surrenders sensitive device permissions, the attack is complete.
If you accidentally tap a link, do not panic—close the browser window immediately. Even if a file downloaded, deleting it without running the installer keeps you safe. If you have already installed the app, switch to Airplane Mode right away to cut off all data connections. Then, use another phone to contact your bank to freeze your accounts and report the incident to the police. In South Korea, you can report incidents and get malware support through the Korea Internet & Security Agency (118) and the Financial Supervisory Service (1332), and you should also notify your mobile carrier to block unauthorized carrier billing.
Common misconceptions
Tapping a link in a smishing text instantly drains all the money from your bank account.
Even after tapping the link, you can avoid catastrophic loss as long as you do not enter personal data or install malicious apps and grant device permissions.
Where you meet it
A text claiming an undelivered parcel has an incorrect address, accompanied by a link to verify the details.
A message pretending to be a mobile wedding invitation from an acquaintance, tempting you to open the attached link.
In one sentence
Smishing is a text-based scam that lures victims through links to fake websites or tricks them into installing malware to steal sensitive financial information.