Smishing is a phishing technique that uses SMS (Short Message Service). A portmanteau of "SMS" and "phishing," it uses links inside fraudulent messages to steer recipients to fake websites and steal personal and credit card details. Because the delivery route differs from email-based phishing, the Council of Anti-Phishing Japan calls out smishing separately in its monthly reports as a route distinct from email phishing.
Typical techniques fall into four patterns. First, fake delivery notices impersonating courier companies ("We tried to deliver your parcel but you were out"). Second, security alerts impersonating banks ("Unauthorized access to your account was detected"). Third, overdue-bill notices impersonating telecom carriers ("Your usage fees are unpaid. Please pay today"). Fourth, refund notices impersonating government offices ("You are due a tax refund"). All of them use urgency to crowd out calm judgment, then ask for an ID, password, or card number on a fake site built to look like the real one.
Smishing is harder to spot than email phishing because of the way SMS arrives. Spam filters move most fraudulent email into a junk folder, but an SMS needs only a phone number, lands in the handset's built-in messaging app, and shows the opening words of its text in a notification, so recipients tend to read it on the spot. On top of that, caller ID spoofing can place a legitimate company name or phone number in the sender field, which makes a fake hard to tell apart from the real thing. On Android there are also reports of fake sites pushing a malicious app that then sends the same message to every contact stored on the device.
The basic defense is to never tap a link inside an SMS. For a delivery notice, check the official app or website directly; for a bank message, log in from your own bookmark. Ignoring and deleting a message you had no reason to expect is the safest response. Turning on the handset's own filtering, such as "Filter Unknown Senders" on iPhone or "Spam protection" in the Android Messages app, keeps suspicious messages out of your notifications, though the exact names vary by OS version. Caller ID Spoofing - How It Works and How to Spot It explains how a sender display can be falsified. If a message looks suspicious, you can also paste its text into the SMS Scam Checker.