Understanding smishing and the FBI’s role in combating mobile text scams

What is smishing and how the FBI responds

Smishing is a form of phishing carried out via SMS text messages, where attackers impersonate trusted organizations to steal personal information, deliver malware, or trick victims into sending money. The FBI’s Internet Crime Complaint Center (IC3) plays a key role in collecting reports, tracking trends, and partnering with law enforcement and private sector partners to disrupt these scams. While the FBI does not directly resolve individual cases or request payments, it provides public guidance, warnings, and resources to help the public recognize and report fraud. Understanding how smishing works and how the FBI fits into the broader ecosystem of fraud response can help you reduce risk and assist investigations.

How smishing works and why it is effective

Common smishing tactics and lures

Smishing messages often impersonate government agencies, financial institutions, couriers, or tech support, creating urgency with claims of compromised accounts, package issues, or fines. Attackers may use spoofed sender IDs, shortcodes, or lookalike domains to appear legitimate, and they will commonly include links to phishing sites or prompt direct replies with personal details. These messages are effective because they exploit trust, fear, and convenience, leveraging familiar branding and timely scenarios to bypass skepticism.

Impact on individuals and organizations

Successful smishing can lead to account takeover, identity theft, and financial loss, while organizations may face brand damage, customer churn, and increased fraud-related costs. When users click malicious links, devices can be infected with credential-stealing malware or redirected to fake login pages that harvest passwords and one-time codes. Because text messages are perceived as more personal and trustworthy than email, people are often less guarded, making smishing a favored channel for attackers seeking sensitive data or quick monetary payouts.

• Stolen credentials and account access
• Malware installation via links or attachments
• Financial loss through fake payments or purchases
• Data harvested on fake websites

The FBI’s structure and mandate around smishing

IC3: reporting and public awareness

The FBI’s Internet Crime Complaint Center (IC3) serves as the primary channel for reporting suspected internet fraud, including smishing. IC3 collects detailed reports, triages them by category, and shares high-value indicators with law enforcement partners for potential investigations and prosecutions. The FBI also publishes alerts, advisories, and educational materials to raise awareness about evolving smishing techniques and to help the public understand how to respond appropriately.

Law enforcement partnerships and disruption

The FBI works with domestic and international partners through task forces and information-sharing initiatives to investigate and disrupt smishing operations. These collaborations support evidence gathering, suspect identification, and takedown actions against criminal infrastructure. Although arrests and prosecutions depend on the quality of evidence and jurisdictional factors, the FBI’s coordinated efforts aim to reduce the scale and success of mobile text scams over time.

Verifiable attributes of FBI involvement in smishing responses

How to recognize smishing attempts

Red flags in text messages

Recognizing smishing starts with questioning unexpected messages that create urgency, request sensitive information, or instruct you to click links or dial numbers. Common red flags include unsolicited requests for passwords, PINs, or one-time codes, messages from unknown senders claiming to be government agencies or company representatives, and links that do not match the official domain. Verify by contacting the organization through official channels, such as phone numbers or websites you already trust, rather than using contact details provided in the message.

How to report smishing to the FBI

To report suspected smishing to the FBI, submit a detailed report via the IC3 portal at ic3.gov. Include the full SMS text, sender number, timestamps, and any links or phone numbers you observed, as well as a description of what happened if you interacted with the message. Even if you did not lose money, reporting helps the FBI track patterns and build investigative leads. The FBI treats these reports seriously, but individuals should not expect direct updates on case progress due to investigative and privacy considerations.

Practical defense strategies and best practices

Prevention, detection, and response

Defending against smishing involves a combination of skepticism, technical controls, and clear reporting practices. Question unexpected messages, avoid clicking links or calling numbers in unsolicited texts, and enable multi-factor authentication on important accounts using a hardware key or authenticator app rather than SMS-based codes. Use carrier features and security apps to filter known spam numbers, keep devices and apps updated, and back up data regularly. If you suspect a smishing attempt, report it to your organization’s security team, to your financial institution, and to the FBI via IC3 to support broader tracking and disruption efforts.