Adaptive Security

## How does SMS phishing compare to email phishing?

Many organizations find that employees are actually more likely to fall for an SMS phishing attempt than an email phish. One reason is that text messages bypass the layers of security (spam filters, warning banners, etc.) that emails go through – so the malicious SMS arrives looking "clean," often with no warning labels. Additionally, people receive fewer texts than emails, so they tend to pay more attention and trust that quick vibration in their pocket; attackers exploit that sense of urgency and legitimacy ("It's a text from our boss, it must be important"). SMS messages are also short and can spoof sender names easily (via certain services), so it might simply appear as "Company HR" on the phone, which users might not question. Because of these factors, smishing can have a higher success (or failure, from the defender's view) rate. For example, users who have become wary of strange emails might still be tricked by a well-timed text message. In essence, smishing can sneak under the radar – both technological and psychological – that people have for email phishing, making it a potent threat that often needs extra emphasis in training.