Short Message Service (SMS) Phishing Attacks and Defenses: A Comprehensive Review

Every day, billions of people carry a device in their pocket that serves as a direct line to their bank accounts, their personal photos, and their most private conversations. Because we rely on these devices for so much, criminals have found a way to turn that trust against us. They send text messages that look like they come from a trusted company, a delivery service, or even a friend. These messages often create a sense of panic or urgency, telling the recipient that their account is locked, a package is waiting, or a prize has been won. The goal is to trick the person into clicking a link or typing in a password. This specific type of trickery, known as SMS phishing or "smishing," has become a massive global problem. In the United States alone, these text-based scams cost users nearly $640 million in a single recent year, a figure that has jumped more than sixfold in just five years. The situation is getting worse because the criminals are not just sending the same old messages; they are using new tools to make their lies sound more convincing and harder to spot.

A team of researchers at Tennessee Technological University and the University of Colorado Colorado Springs decided to take a step back to understand the full scope of this growing threat. Instead of just building a new tool to block one type of bad message, they conducted a comprehensive review of everything known about smishing. They gathered and analyzed hundreds of scientific studies, legal documents, and public data sets to create a complete map of the problem. Their work covers four main areas: how people react to these messages, how the attacks are structured, what defenses currently exist, and what data researchers have available to study the issue. By bringing all these pieces together, they hope to show where current efforts are falling short and point the way toward better protection for everyone.

The researchers first looked at the people on the receiving end of these messages. They found that susceptibility to these scams is not just about being careless or uneducated. While some people are more likely to fall for a trick than others, the risk is influenced by a complex mix of habits, emotions, and context. For instance, someone who frequently uses social media or banking apps might find a message related to those services more believable, simply because it feels familiar. The study also highlighted that attackers are experts at using human psychology. They craft messages that trigger fear, greed, or a sense of urgency, pushing people to act quickly without thinking. The researchers noted that while some defenses focus on technical details, the human element remains the weakest link. Even people who know about scams can be tricked if the message is well-designed to exploit their specific fears or desires.

When it comes to the attacks themselves, the researchers found that the landscape has become incredibly diverse. In the past, smishing messages were often crude, filled with bad grammar and obvious links. Today, the attacks are much more sophisticated. They can come from numbers that look exactly like those of legitimate organizations, or they can be sent in massive waves to random people. The researchers identified that these attacks often follow specific themes, such as fake tax refunds, delivery notifications, or account security alerts. They also observed that criminals are beginning to use artificial intelligence to write these messages, making them sound perfectly natural and tailored to the victim. This evolution means that old methods of blocking messages, which relied on simple lists of bad words or known bad links, are no longer enough. The attackers are constantly changing their tactics to slip past these filters.

To fight back, the researchers examined the current state of defense. They found that most modern solutions rely on machine learning, a type of computer program that learns to recognize patterns from large amounts of data. These programs are getting very good at spotting suspicious text, with some recent models achieving accuracy rates above 99 percent. However, the researchers pointed out a significant problem: many of these powerful systems are "black boxes." They can tell you that a message is a scam, but they cannot easily explain why. This lack of transparency makes it hard for users to trust the warnings or for regulators to understand how the decisions are made. Furthermore, while there are many mobile apps designed to block these messages, their effectiveness varies widely. Some are excellent at catching scams, while others miss many of them or block too many harmless messages. The study also looked at laws and regulations, finding that while some countries have strong rules against these practices, enforcement is often difficult and inconsistent across different regions.

A major part of the researchers' work involved analyzing the data sets that scientists use to train these detection systems. They discovered that many of these data sets are outdated or limited. For example, some older data sets contain messages from a decade ago that do not reflect how scammers operate today. Others are heavily biased toward English, leaving a gap in understanding how these attacks work in other languages. The researchers also found that many data sets contain links to websites that no longer exist, which makes it difficult to study the actual destinations of these scams. To address this, they created a new, unified collection of data called the "Smishing Data Hub," which organizes and cleans up existing information to help future researchers build better defenses.

The review concludes that while technology is advancing, the battle against smishing requires a broader approach. The researchers suggest that future efforts must go beyond just building better filters. They argue for a deeper understanding of the psychological tricks used by scammers, so that users can be taught to recognize the emotional manipulation behind the words. They also call for more diverse data sets that include messages in many different languages and formats, not just text. Finally, they emphasize the need for better collaboration between technology companies, law enforcement, and policymakers to create a more coordinated response. The study does not claim to have solved the problem, but it provides a clear roadmap for how the scientific community can move forward to protect users in an increasingly deceptive digital world.