Smishing and Messaging-App Scams: When Attackers Move Off Email
Your email security stack is probably doing its job. Filters catch most of the obvious phishing, links get rewritten, and attachments get detonated in sandboxes. Attackers know this, so they are going where your defenses are thinner. Smishing and messaging-app scams now sit at the center of that shift, and many security programs still treat them as an afterthought.
Smishing is phishing delivered by SMS. The same tactics now show up in WhatsApp, Telegram, Signal, iMessage, Microsoft Teams, and LinkedIn messages. The channel changes, but the goal stays the same: get a person to click, reply, or hand over something valuable.
This post explains why attackers are moving off email, what these attacks look like in practice, and what your security team can do about them.
Why Attackers Are Moving Beyond Email
Email gets the most defensive investment, and attackers respond to that. A well-run mail gateway forces them to spend real effort on every campaign. A text message costs almost nothing to send and faces far less inspection.
Several factors make messaging channels attractive.
Fewer technical controls. Most organizations have no equivalent of a secure email gateway for SMS. Personal messaging apps sit entirely outside corporate visibility. Even on managed devices, security teams rarely see message content or link destinations.
Higher trust and attention. People treat their phones as personal space. A text message feels more urgent and more intimate than an email. Many employees read messages within minutes, while a suspicious email might sit in a folder for hours.
Smaller screens, weaker cues. On a phone, the full URL is often hidden. The sender field shows a name or a number, not an address. Users lose many of the visual checks they rely on at a desktop.
Blurred work and personal lines. Employees use personal devices for work, and they use work devices for personal tasks. A scam aimed at someone’s personal life can still land on a device that holds corporate email, single sign-on tokens, and VPN profiles.
None of this means email threats are fading. It means attackers now run multi-channel campaigns, and defenders need to match them.
What Smishing Actually Looks Like
Smishing messages tend to follow a few familiar patterns. Once your team recognizes them, they become easier to spot and easier to teach.
Delivery and parcel notices. A short message claims a package is held and asks the recipient to confirm an address or pay a small fee. The link leads to a convincing payment page. The attacker collects card details and often personal data as well.
Bank and payment alerts. The message warns of suspicious activity and asks the user to verify a transaction. Some include a phone number to call, which routes the victim to a fake support agent.
Account verification and MFA fatigue. Attackers pair a text with a login attempt on a real service. The victim receives a genuine one-time code, then a follow-up message from a supposed support team asking them to read the code back. That code gives the attacker access.
Workplace impersonation. A message appears to come from a manager, an executive, or the IT help desk. It asks for a quick favor, such as buying gift cards, approving a payment, or sharing a login.
Toll, fine, and government notices. These messages claim an unpaid fee or a legal deadline. They rely on fear of penalties and on the recipient’s limited time to check.
Each pattern works the same way. It creates urgency, narrows the options, and pushes the victim toward a single action.
Messaging-App Scams Are a Different Problem
SMS is only part of the picture. Apps like WhatsApp and Telegram bring their own risks, because they support rich interaction and long conversations.
The “wrong number” opener. A stranger sends a casual message, such as an apology for a missed meeting. The conversation drifts toward friendship, then toward an investment opportunity. These scams can run for weeks before any money moves.
Account takeover through verification codes. An attacker triggers a WhatsApp registration on the victim’s number, then tricks the victim into sharing the code. Once inside, the attacker messages the victim’s contacts and asks for money or credentials. Those contacts trust the message because it comes from someone they know.
Fake group chats and job offers. Scammers add people to groups that look active, full of supposed members praising a work-from-home opportunity or a trading signal. The crowd is fake, but the social proof feels real.
Collaboration platform impersonation. Attackers contact employees through Teams, Slack, or similar tools, often posing as IT support. They may send a link to a “security update” or ask the employee to approve a remote access session.
QR codes in images. A QR code inside a picture slips past text-based link scanning. Scanning it on a phone moves the victim to an unmanaged device and a fresh browser session.
The common thread is trust. Attackers invest time in building a relationship, and they use the platform’s own legitimacy to lower the victim’s guard.
A Realistic Scenario: The Finance Manager and the “CEO” on WhatsApp
Consider a mid-sized logistics company with about 600 employees. The finance manager, Ayşe, has her work phone number listed on the company’s public website and on her LinkedIn profile.
On a Tuesday morning, she receives a WhatsApp message from an unknown number. The profile photo shows the company’s CEO, taken from a conference page. The message reads: “Ayşe, I’m in meetings all day and can’t talk. I need you to handle something confidential today. Are you available?”
She replies. The attacker responds with a short, calm follow-up. A supplier has changed banks, the CEO says, and an urgent payment must go out before noon to avoid a contract penalty. The message includes new account details and asks her to keep the matter quiet until the deal closes.
Several things work in the attacker’s favor. The message arrived outside the email system, so no gateway flagged it. The request mimics how executives actually behave, which is short, rushed, and slightly secretive. The attacker also picked a moment when the real CEO was publicly listed as traveling.
Ayşe pauses, because the number is unfamiliar. She calls the CEO’s known mobile number from the company directory. He picks up and confirms he sent nothing. The payment never goes out.
That outcome depended on two things. Ayşe had been trained to treat out-of-channel requests with suspicion, and the company had a clear rule that payment changes require verbal confirmation through a known number. Without either, the story could have ended differently.
This pattern is a variation of business email compromise, moved to a channel where fewer controls apply. Security teams that only monitor email will never see it.
Why Technical Controls Alone Fall Short
Mobile threat defense tools, DNS filtering, and managed device policies all help. They reduce risk, and organizations with mobile-heavy workforces should consider them. But they cannot cover everything.
Personal devices fall outside corporate policy. Encrypted messaging apps hide content from inspection by design. Attackers also rotate numbers, domains, and short links faster than blocklists can keep up.
This is why the human layer matters so much. The employee who stops and thinks before tapping a link is often the only control that works. That judgment needs practice, and practice needs realistic scenarios.
What Security Teams Can Do Right Now
You do not need a large budget to improve your position against smishing. These steps give you a solid starting point.
- Extend your policy to cover messaging channels. Your acceptable use and incident reporting policies should name SMS, WhatsApp, Teams, and other platforms explicitly. Employees need to know that a suspicious text is as reportable as a suspicious email.
- Create a simple reporting path for mobile threats. If reporting requires logging into a laptop and filling out a form, people will skip it. Offer a dedicated number, a chat channel, or a one-tap option that works from a phone.
- Set out-of-band verification rules for sensitive requests. Payment changes, credential resets, and data transfers should require confirmation through a second channel. The confirmation must use contact details the company already holds, not details supplied in the message.
- Protect your high-value targets. Finance, HR, executive assistants, and IT help desk staff attract the most attention. Review how much of their contact information is public, and give them extra training.
- Harden account recovery and MFA. Move away from SMS-based codes where you can. Phishing-resistant methods like hardware keys or passkeys reduce the value of stolen codes. Teach employees never to share a verification code with anyone, including someone claiming to be support.
- Lock down messaging app settings. On managed devices, enable two-step verification in apps like WhatsApp, restrict who can add users to groups, and disable link previews where possible.
- Brief executives on impersonation. Leaders should know their names and photos will be used in scams. Encourage them to tell staff how they will, and will not, make requests.
- Run realistic simulations on mobile channels. Training that only covers email leaves a gap. Employees need to see what a smishing attempt looks like on a phone screen, with the same pressure they would feel in real life.
- Rehearse the response. Decide in advance who handles a reported smishing incident, how compromised accounts get reset, and when to notify customers or partners. A short tabletop exercise is enough to expose weak points.
- Watch for leaked data. Attackers often start with information from earlier breaches, such as phone numbers, job titles, and reused passwords. Knowing what is already exposed helps you predict who will be targeted.
Building Habits That Last
Awareness training works best when it is frequent, short, and relevant. A once-a-year video does little against a scam that arrives on a Tuesday morning with a convincing profile photo.
Good programs teach a few durable habits. Pause before acting on urgency. Verify through a second channel. Treat unexpected links and codes as suspect. Report quickly, even when unsure.
They also avoid blame. An employee who clicked a link and reports it within minutes saves the company far more than one who stays quiet out of embarrassment. Security teams should thank people for reporting, every time.
Measurement matters too. Track reporting rates alongside click rates, because a rising reporting rate shows that the culture is changing. A low click rate with no reports can mean employees are simply not noticing the tests.
Where Cruxroot Fits In
Closing the gap between email-focused defenses and multi-channel attacks takes a mix of practice, visibility, and engagement. Cruxroot was built around those three needs, and it reaches customers through our MSP and reseller partners.
Phishing simulations. Cruxroot lets teams run realistic simulations that go beyond the inbox, including text-style lures and impersonation scenarios. Employees see the kinds of messages they will actually receive, and they get immediate feedback when they respond. Results show which departments and roles need more support.
Dark web monitoring. Exposed credentials and personal details fuel targeted smishing. Cruxroot’s dark web monitoring alerts you when company-related data appears in leaked sets. That gives your team time to reset passwords, warn at-risk staff, and close gaps before an attacker uses the data.
Gamified training. Short, game-style modules keep employees engaged without pulling them away from work for long. People remember what they practice, and a bit of friendly competition encourages repeat participation. The format suits mobile threats well, because the lessons mirror quick decisions on a small screen.
No platform stops every attack, and Cruxroot does not claim to. What it does is help your people build better instincts, and help your security team see risk earlier. Your MSP partner can walk you through how these features fit your environment and your existing tools.
Conclusion
Attackers follow the path of least resistance. As email defenses improve, they turn to text messages, messaging apps, and collaboration tools, where controls are weaker and trust is higher. Smishing and messaging-app scams will keep growing as long as they keep working.
The good news is that practical steps make a real difference. Extend your policies to cover every channel. Make reporting easy. Set clear verification rules for sensitive requests. Train people with realistic scenarios, and watch for the data attackers use against you.
Start with one change this week. Pick the highest-risk team in your organization and walk them through a real smishing example. That single conversation may be what stops the next attack.
Check our latest the blog regarding Tailgating and Physical Social Engineering: The Attack Your Firewall Can’t Stop
