Smishing is phishing delivered by SMS text message instead of email. The attacker impersonates a trusted source, a bank, a delivery courier, or an internal IT alert, and uses urgency to get the recipient to click a link or hand over sensitive information before they've had time to think it through.

That definition sounds simple. What makes smishing dangerous is how ordinary it feels when it actually happens.

For security teams, that is the real problem. Employees who have learned to scrutinise suspicious emails often bring none of that caution to their phones, and attackers know it.

A few years ago, a technology lawyer in California took a call that appeared to come from his own bank. The caller asked whether he'd just tried to withdraw cash in Miami. He hadn't, so he said no. The caller offered to verify his identity by sending a one, time PIN to his phone, the same kind of code his bank had texted him before. It arrived from his bank's real number. He read it back over the phone.

That single step let the scammer reset his password and view his real transaction history, which the caller then read back to him to sound even more credible. The call only fell apart when the caller asked for his bank PIN directly, a request his actual bank would never make. He hung up and called the real fraud line immediately.

What made this attack work wasn't a sloppy fake text message. It was that the verification code came from the bank's genuine phone number. The scammer hadn't broken the bank's systems. They had simply asked the bank to send a code, then asked the victim to hand it over.

In the UAE, one of the most persistent smishing patterns doesn't ask for much at all, which is exactly why it works. Residents have reported receiving texts claiming a courier package is being held over an unpaid fee of three or four dirhams. The message links to a page that looks like a real courier or postal service, asking the victim to enter card details to release the parcel.

Abu Dhabi Police and the UAE Cybersecurity Council have issued repeated warnings about this exact scheme, and cases have run into real losses. In one reported instance, a resident's aunt paid what she believed was a four, dirham redelivery charge and ended up losing roughly ten thousand dirhams from her account once her card details were captured.

The UAE Central Bank has separately warned consumers that it never contacts customers by phone or text to say a card has been blocked, precisely because that message is now a common impersonation script.

The pattern works because the ask is small enough to feel harmless, and the emotional trigger, an expected package, is one almost everyone can relate to at any given moment.

Text messages get a level of trust that email lost years ago. A phone's small screen hides the sender's actual number and often truncates the link, so the usual red flags, a strange domain or a mismatched sender address, simply aren't visible.

Messages also arrive with urgency built in: an account frozen, a package on hold, a payment about to fail. There's no time to forward it to IT and ask if it's real.

Security, aware employees who scrutinise suspicious emails will often act on a text within seconds, precisely because texting feels personal and immediate in a way email no longer does.

The three attack types share the same goal but reach employees through different channels.

The classic hook: fake invoices, password reset requests, and executive impersonation delivered to the inbox.

Delivery alerts, bank fraud warnings, and MFA code requests sent straight to an employee's phone.

Urgent verbal requests, increasingly made with AI voice cloning, and frequently paired with a smishing text as backup.

These three increasingly work together rather than separately. The California case above blended a phone call with a smishing, style text, and a well, run attack today often chains all three across channels in the same attempt.

Employee awareness training helps, but a once, a, year module doesn't prepare anyone for a message that arrives exactly when they're expecting a parcel. The organisations that hold up best under real smishing attempts share three things.

If reporting a suspicious text takes more effort than ignoring it, most people will ignore it. Reporting should take seconds, and employees should see that their reports lead somewhere.

Not just email, but SMS specifically. The muscle memory for spotting a fake text is different from spotting a fake email, and it only builds through repeated, realistic practice.

Employees and customers alike need to know, explicitly and repeatedly, that a legitimate one, time code is never something anyone should ask them to read back.

Smishing succeeds because it meets people where their guard is lowest: on their phones, in the middle of an ordinary day. Email, only phishing training leaves this gap uncovered, which is why SimuPhish runs simulated smishing campaigns alongside email, voice, and QR, based phishing as part of its multi, channel testing.