What does smishing mean? FBI's latest warning on text scam explained

FBI has recently started issuing warnings to the general public about smishing text scams, which aim to steal personal information. A report by Fox 5 DC on March 12, 2025, stated that the FBI had told people to delete the scam messages and immediately get in touch with the Internet Crime Complaint Center, also called IC3, by filing a complaint.

Notably, the scam was identified in April last year, and the official website of IC3 also shared an announcement on behalf of the FBI at the time. The scam was related to unpaid road toll services at the time, and certain messages mentioned that the recipient needed to pay for pending bills, and they featured almost similar language.

The IC3 website also explains smishing, a “social engineering attack” in which text messages are used to let people download malware, share private information, and send money to cybercriminals. It is a term that combines SMS and phishing.

Furthermore, the scam is also used to steal anyone’s credit card and bank account details, and apart from that, it also sends fake delivery service alerts featuring random links, as reported by cybersecurity company Palo Alto Networks’ Unit 42.

The pattern of unpaid bills is still being used in the smishing scam, stating that if people don’t complete the payment, it might lead to penalties. Cybersecurity firm McAfee also prepared a list of cities that have been impacted by the scams, including Atlanta, Chicago, Dallas, Orlando, and Los Angeles.

While speaking to WXYZ Detroit on March 11, a victim named Maisha Floyd said that when she tried to make the payment by opening the link, a message appeared on the screen stating that her card was denied. She addressed her experience by saying:

“It was actually professional looking. I didn’t see any red flags with it. I honestly didn’t.”

---

Smishing scam messages: Prevention methods and more

FBI’s latest warning about the smishing scam stated that cybercriminals are using 10,000 domains to send messages, as per Forbes magazine. Furthermore, the scam is being committed by borrowing toolkits from Chinese cybercriminal groups and a few domains with .XIN top-level domain from China has been discovered until now.

Apart from filing a complaint at the IC3 with the phone number from where the message was sent alongside the website included in the text, the FBI has additionally told the public to open the toll service website and get in touch with customer care to verify any pending payments.

The Federal Trade Commission, also called FTC, has told people to report scam texts by using the feature of Report Junk on smartphones. Apart from this, the FBI has advised people to secure their respective accounts in case their personal information has been compromised in any manner.

According to Kaspersky, smishing scam is done through email, and they mostly come from the bank, requesting details such as account number. Cybercriminals might appear in the disguise of legitimate organizations and use certain situations relevant to the person they are targeting for the scam.

Cybercriminals might opt to target a group of people in certain locations, such as universities, and they allegedly use cheap and disposable phones to commit the crime. People using iOS devices also cannot protect themselves from the scam despite Apple’s operating system having a technology to prevent such attacks.

In case someone gets attacked, the individual must report the attack to institutions that can help them, as per Kaspersky. People also need to change all the passwords and PINs for their accounts at the same time. The scam has different forms that have been expanded to COVID-19 aid programs, financial services, gifts, billing invoices, and customer support.

Smishing scams can be prevented through certain methods, including checking the phone number, specifically odd ones with 4 digits, from which they have received the message. People can also download anti-malware apps on their devices and use multi-factor authentication, which involves a text message verification code.