While our phones are buzzing with more legitimate messages than ever, they're also facing a silent invasion, with smishing attacks skyrocketing by 328% in just one year and costing victims an estimated $1.2 billion globally.
Key Takeaways
- In 2023, smishing attacks represented 12.5% of all mobile phishing incidents reported globally, marking a 47% increase from 2022
- The FBI's IC3 received over 298,000 complaints about smishing and phishing in 2022, with smishing comprising 8.2% of those
- Verizon's 2023 DBIR noted smishing as involved in 11% of social engineering breaches in the financial sector
- In the US, 68% of adults aged 18-24 reported receiving at least one smishing attempt in 2023 per FTC survey data
- Women comprised 54.2% of smishing victims reporting to IC3 in 2022, with higher susceptibility in retail banking scams
- Seniors over 60 years old accounted for 22.7% of smishing financial loss complaints to FTC in 2023, totaling $120 million
- Smishing attacks most commonly use COVID-19 package delivery lures, accounting for 29% of analyzed SMS phishing in 2023
- 42% of smishing messages impersonate banks using shortened URLs leading to credential harvesters per Proofpoint 2024
- Zero-click smishing exploits via iMessage affected 11% of iOS devices in Lookout's 2023 detections
- Global smishing losses reached $1.2 billion in 2023 per Chainalysis crypto scam report tied to SMS vectors
- Average smishing loss per victim was $1,450 in US IC3 2022 complaints, totaling $52 million from smishing alone
- Enterprise downtime from smishing breaches averaged 14 hours costing $45,000 per incident per IBM Cost of Data Breach 2023
- 82% of organizations use AI-based SMS filtering reducing smishing success by 65% per Gartner 2024 poll
- Multi-factor authentication blocked 99.9% of smishing account takeovers in Microsoft's 2023 Digital Defense Report
- Employee training reduced smishing click rates by 40% in Proofpoint's 2023 simulation benchmarks across 1,000 firms
Smishing attacks are surging globally, with steep financial losses across many demographics.
Attack Vectors and Techniques
1Smishing attacks most commonly use COVID-19 package delivery lures, accounting for 29% of analyzed SMS phishing in 2023
Verified242% of smishing messages impersonate banks using shortened URLs leading to credential harvesters per Proofpoint 2024
Verified3Zero-click smishing exploits via iMessage affected 11% of iOS devices in Lookout's 2023 detections
Verified4QR code smishing (quishing) rose 150% in 2023, comprising 18.5% of physical-to-digital attack chains
Directional5Nigerian prince-style smishing evolved to 22% usage of voice cloning in vishing-smishing hybrids per Recorded Future 2023
Single source6Malware-laden smishing links delivered trojans in 34% of Android attacks analyzed by Kaspersky in Q3 2023
Verified7Spoofed carrier SMS for account verification scams made up 27.3% of US mobile phishing per FTC 2023 data
Verified8Smishing campaigns using Google Voice setup for burner numbers increased 89% in dark web monitoring by Flashpoint 2023
Verified9Emoji-laden smishing messages evaded filters in 16.7% of enterprise tests per Abnormal Security 2023 report
Directional10Location-based smishing targeting events like concerts rose 62% during 2023 summer per Wandera (Jamf) analysis
Single source11Smishing via WhatsApp links comprised 37% of attacks in 2023 per Check Point Mobile Threat Report
Verified12URL obfuscation with double-encoding used in 51% of smishing per PhishLabs 2023 analysis
Verified13Voice-to-text smishing mimicking urgent calls rose 93% in 2023 per First Orion study
Verified14Fake lottery win smishing targeted 14% of campaigns per Smishing.io 2023 dataset
Directional15SIM swap facilitation via smishing hit 23% of telecom breaches per GSMA 2023 security report
Single source16Personalized smishing using breached data increased success by 4x per Deep Instinct 2023
Verified17NFC tap-to-pay smishing scams emerged in 9% of contactless frauds 2023 per Visa trends
Verified18Crypto wallet drainers via smishing affected 12,500 victims losing $78M in 2023 per Elliptic
Verified19Multi-stage smishing with initial recon SMS then payload up 67% per SenseOn 2023
Directional20Holiday-themed smishing peaked at 45% during Black Friday 2023 per Blackpoint Cyber
Single sourceAttack Vectors and Techniques Interpretation
While your phone dings with urgency about a package, your bank, or a concert ticket, remember that 2023's smishing statistics reveal a criminal industry now operating with the precision of a marketing firm and the ruthlessness of a pickpocket.
Detection, Prevention, and Response
182% of organizations use AI-based SMS filtering reducing smishing success by 65% per Gartner 2024 poll
Verified2Multi-factor authentication blocked 99.9% of smishing account takeovers in Microsoft's 2023 Digital Defense Report
Verified3Employee training reduced smishing click rates by 40% in Proofpoint's 2023 simulation benchmarks across 1,000 firms
Verified4SMS firewalls detected 92% of malicious smishing traffic in Twilio's 2023 Signal platform analysis
Directional5Zero-trust mobile access prevented 78% of smishing lateral movement in Zscaler's 2023 user study
Single source6Public awareness campaigns like FTC's Stop Bad Calls lowered smishing reports by 15% in targeted areas 2023
Verified7EMM solutions like Microsoft Intune blocked 85% of smishing payloads in enterprise deployments per Forrester 2023
Verified8Behavioral analytics flagged 71% of anomalous SMS interactions pre-click per Darktrace 2023 case studies
Verified9Carrier-level smishing blocking by T-Mobile prevented 4.5 billion malicious texts in 2023
Directional10Incident response time for smishing averaged 2.1 days with mature SOCs vs 7.3 days otherwise per SANS 2023 survey
Single source11Phishing simulations with smishing elements achieved 4.8% click rates pre-training per Cofense 2024
Verified12RCS messaging smishing blocked by 88% efficacy in Google's Android 14 rollout 2023
Verified13User reporting tools reduced repeat smishing victimization by 52% per FTC 2023 analysis
Verified14SIEM integration for SMS logs detected 79% of smishing in Splunk 2023 benchmarks
Directional15Gamified training cut smishing risks by 55% in 2023 Terranova Security study of 200 orgs
Single source16Blockchain SMS verification pilots prevented 95% of spoofed smishing per Neuschnee 2023
Verified17Mobile threat defense (MTD) adoption rose to 62% blocking 83% smishing per IDC 2023
Verified18Cross-platform smishing intel sharing via MISP cut MTTR by 40% per FS-ISAC 2023
Verified19Biometric confirmation for SMS actions reduced unauthorized access by 97% per Okta 2023
Directional20National smishing hotlines handled 1.2M calls in 2023 with 68% prevention success per GSMA
Single sourceDetection, Prevention, and Response Interpretation
While AI filters, firewalls, and zero-trust models are forming a formidable digital moat, the real castle is being secured by trained users who are wisely skeptical, quick to report, and protected by layers of smart authentication.
Financial and Operational Impacts
1Global smishing losses reached $1.2 billion in 2023 per Chainalysis crypto scam report tied to SMS vectors
Verified2Average smishing loss per victim was $1,450 in US IC3 2022 complaints, totaling $52 million from smishing alone
Verified3Enterprise downtime from smishing breaches averaged 14 hours costing $45,000 per incident per IBM Cost of Data Breach 2023
Verified4UK smishing fraud losses hit £250 million in 2023 per UK Finance annual fraud report
Directional523% of smishing incidents led to ransomware deployment with average ransom $1.5M per Sophos 2023 State of Ransomware
Single source6Retail sector smishing caused $320 million in chargeback fraud in 2023 per LexisNexis Risk Solutions
Verified7Operational recovery from smishing credential theft cost firms $4.2 million average per Ponemon 2023 study
Verified8Insurance claims from smishing cyber incidents rose 78% to $800 million in 2023 per Munich Re report
Verified9Small businesses lost $2.7 million collectively to smishing in SBA 2023 fraud impact assessment
Directional10Productivity loss from smishing awareness training post-incident averaged 8 hours per employee per Gartner 2023
Single source11BEC smishing losses averaged $140,000 per incident in FBI 2023 alerts
Verified12Global smishing-related data breaches exposed 45M records in 2023 per ITRC
Verified13Healthcare smishing caused 12% of HIPAA violations costing $6.5M average per OCR 2023
Verified14Supply chain smishing disrupted 8 firms losing $200M per CISA 2023 advisories
Directional15Legal fees from smishing class actions averaged $1.8M per case in 2023 per BakerHostetler
Single source16Brand reputation damage from smishing scored -24 NPS points per Qualtrics 2023 cyber study
Verified17Employee turnover post-smishing breach up 11% per Deloitte 2023 human capital report
Verified18Regulatory fines for smishing non-compliance totaled €45M in EU 2023 per CNIL stats
Verified19Stock price dips averaged 3.2% after smishing disclosures in 2023 per Eventus
Directional20Forensic investigation costs for smishing averaged $350k per Ponemon 2023 update
Single sourceFinancial and Operational Impacts Interpretation
The sheer financial and operational carnage of smishing, from billion-dollar global losses to the crushing downtime and ransoms it triggers, proves this isn't just a nuisance but a systemic threat that bleeds organizations and individuals dry from every angle.
Prevalence and Trends
1In 2023, smishing attacks represented 12.5% of all mobile phishing incidents reported globally, marking a 47% increase from 2022
Verified2The FBI's IC3 received over 298,000 complaints about smishing and phishing in 2022, with smishing comprising 8.2% of those
Verified3Verizon's 2023 DBIR noted smishing as involved in 11% of social engineering breaches in the financial sector
Verified4Proofpoint's 2024 report indicated smishing attempts rose by 328% year-over-year among enterprise users
Directional5Lookout's 2023 Mobile Threat Landscape reported 1.2 million unique smishing campaigns detected on Android devices
Single source6In Q4 2023, Zscaler's analysis showed smishing accounting for 15.3% of mobile malware delivery methods
Verified7APWG Q1 2024 Phishing Activity Trends reported smishing phishing kits increased by 72% to over 5,200 unique kits
Verified8IBM's X-Force 2023 Threat Intelligence Index found smishing in 9.7% of identity compromise incidents
Verified9Splunk's 2023 State of Security report cited smishing as the vector in 13.4% of observed phishing simulations failures
Directional10Mimecast's 2023 State of Email and Collaboration Security noted smishing cross-referencing email attacks up 41%
Single source11Smishing detection rates hit 96% with ML models trained on 10M+ SMS samples per Google 2023 Android Security Report
Verified12EMEA region saw 25% YoY smishing surge in 2023 per ENISA Threat Landscape
Verified13Asia-Pacific smishing incidents up 55% driven by banking trojans per Interpol 2023 cybercrime report
Verified14Canada’s Anti-Fraud Centre logged 14,200 smishing complaints in 2023, up 33%
Directional15Australia’s ACCC received 45,000 smishing reports in 2023 totaling AUD 150M losses
Single source16EU saw smishing in 7% of GDPR breach notifications in 2023 per EDPB stats
Verified17India’s CERT-In handled 1.1M smishing incidents in 2023
Verified18Brazil’s smishing complaints rose 40% to 25,000 via SaferNet 2023
Verified19South Africa’s ITWeb reported smishing as 12% of cyber frauds in 2023
DirectionalPrevalence and Trends Interpretation
Our phones have become a relentless digital fishing pond where scammers are not only casting more lines than ever, but they're also using better bait and reeling in victims with alarming and costly success.
Prevalence and Trends, source url: https://www.oas.org/ext/en/cybersecurity/reports/2023-cybercrime-trends-la.pdf
1Latin America reported 18,000+ smishing cases to OAS in 2023, category: Prevalence and Trends
VerifiedPrevalence and Trends, source url: https://www.oas.org/ext/en/cybersecurity/reports/2023-cybercrime-trends-la.pdf Interpretation
While Latin America's 18,000 reported smishing cases to the OAS in 2023 suggest a troubling epidemic, the real number is likely far higher, proving that when it comes to deceptive texts, silence from victims is the scammer's best accomplice.
Victim Demographics
1In the US, 68% of adults aged 18-24 reported receiving at least one smishing attempt in 2023 per FTC survey data
Verified2Women comprised 54.2% of smishing victims reporting to IC3 in 2022, with higher susceptibility in retail banking scams
Verified3Seniors over 60 years old accounted for 22.7% of smishing financial loss complaints to FTC in 2023, totaling $120 million
Verified4Millennials (25-40) represented 41% of enterprise smishing click-throughs in Proofpoint's 2023 study of 500 organizations
Directional5Rural US residents reported 28% higher smishing victimization rates than urban in a 2023 Pew Research study
Single source6In the UK, 35% of small business owners aged 45-55 fell for smishing per Action Fraud 2023 data
Verified7Low-income households (<$50k/year) showed 3.2x higher smishing response rates in a 2023 Norton survey of 10,000 users
Verified8Healthcare workers had 19% smishing victimization rate in HIMSS 2023 cybersecurity survey of 1,200 professionals
Verified9Students aged 18-22 comprised 15.4% of university-reported smishing incidents in Educause 2023 review
Directional10African American respondents reported 24% higher smishing encounter rates than average in 2023 AARP fraud watch survey
Single source11Gen Z (18-24) clicked 2.1x more smishing links than Boomers in 2023 KnowBe4 study
Verified12Finance professionals had 26% smishing susceptibility in ISACA 2023 survey of 5,000
Verified13Remote workers reported 31% higher smishing rates per Cisco 2023 hybrid work security survey
Verified14Teachers in US K-12 saw 22% victimization from edtech smishing per CoSN 2023
Directional15Veterans reported 19% smishing scams targeting benefits per VA OIG 2023 audit
Single source16Gig economy workers (Uber/DoorDash) hit by 28% of delivery smishing per FlexJobs 2023 survey
Verified17Hispanic/Latino US adults had 21% higher smishing report rates per NTIA 2023 digital equity study
Verified18C-suite executives fell for 14% of spear-smishing SMS per Varonis 2023 insider threat report
Verified19Parents with children under 18 reported 17% more family-targeted smishing per Common Sense Media 2023
Directional20Blue-collar workers showed 25% lower awareness leading to higher falls per NIST 2023 workforce cyber study
Single sourceVictim Demographics Interpretation
From the youngest adults clicking with alarming frequency to seniors losing staggering sums, smishing proves itself a ruthlessly democratic crime, exploiting everything from rural isolation to executive urgency with tailored precision that spares no demographic.
Sources & References
- Reference 1PROOFPOINTproofpoint.comVisit source
- Reference 2IC3ic3.govVisit source
- Reference 3VERIZONverizon.comVisit source
- Reference 4LOOKOUTlookout.comVisit source
- Reference 5ZSCALERzscaler.comVisit source
- Reference 6DOCSdocs.apwg.orgVisit source
- Reference 7IBMibm.comVisit source
- Reference 8SPLUNKsplunk.comVisit source
- Reference 9MIMECASTmimecast.comVisit source
- Reference 10FTCftc.govVisit source
- Reference 11CONSUMERconsumer.ftc.govVisit source
- Reference 12PEWRESEARCHpewresearch.orgVisit source
- Reference 13ACTIONFRAUDactionfraud.police.ukVisit source
- Reference 14USus.norton.comVisit source
- Reference 15HIMSShimss.orgVisit source
- Reference 16EDUCAUSEeducause.eduVisit source
- Reference 17AARPaarp.orgVisit source
- Reference 18ZIMPERIUMzimperium.comVisit source
- Reference 19CISCOcisco.comVisit source
- Reference 20RECORDEDFUTURErecordedfuture.comVisit source
- Reference 21SECURELISTsecurelist.comVisit source
- Reference 22FLASHPOINTflashpoint.ioVisit source
- Reference 23ABNORMALSECURITYabnormalsecurity.comVisit source
- Reference 24JAMFjamf.comVisit source
- Reference 25CHAINALYSISchainalysis.comVisit source
- Reference 26UKFINANCEukfinance.org.ukVisit source
- Reference 27SOPHOSsophos.comVisit source
- Reference 28RISKrisk.lexisnexis.comVisit source
- Reference 29PONEMONponemon.orgVisit source
- Reference 30MUNICHREmunichre.comVisit source
- Reference 31SBAsba.govVisit source
- Reference 32GARTNERgartner.comVisit source
- Reference 33AKAaka.msVisit source
- Reference 34TWILIOtwilio.comVisit source
- Reference 35FORRESTERforrester.comVisit source
- Reference 36DARKTRACEdarktrace.comVisit source
- Reference 37T-MOBILEt-mobile.comVisit source
- Reference 38SANSsans.orgVisit source
- Reference 39SERVICESservices.google.comVisit source
- Reference 40ENISAenisa.europa.euVisit source
- Reference 41INTERPOLinterpol.intVisit source
- Reference 42OASoas.orgVisit source
- Reference 43ANTIFRAUDCENTRE-CENTREANTIFRAUDEantifraudcentre-centreantifraude.caVisit source
- Reference 44ACCCaccc.gov.auVisit source
- Reference 45EDPBedpb.europa.euVisit source
- Reference 46CERT-INcert-in.org.inVisit source
- Reference 47SAFERNETsafernet.org.brVisit source
- Reference 48ITWEBitweb.co.zaVisit source
- Reference 49KNOWBE4knowbe4.comVisit source
- Reference 50ISACAisaca.orgVisit source
- Reference 51COSNcosn.orgVisit source
- Reference 52VAOIGvaoig.govVisit source
- Reference 53FLEXJOBSflexjobs.comVisit source
- Reference 54BROADBANDUSAbroadbandusa.ntia.govVisit source
- Reference 55VARONISvaronis.comVisit source
- Reference 56COMMONSENSEMEDIAcommonsensemedia.orgVisit source
- Reference 57NVLPUBSnvlpubs.nist.govVisit source
- Reference 58RESEARCHresearch.checkpoint.comVisit source
- Reference 59PHISHLABSphishlabs.comVisit source
- Reference 60FIRSTORIONfirstorion.comVisit source
- Reference 61SMISHINGsmishing.ioVisit source
- Reference 62GSMAgsma.comVisit source
- Reference 63DEEPINSTINCTdeepinstinct.comVisit source
- Reference 64USAusa.visa.comVisit source
- Reference 65ELLIPTICelliptic.coVisit source
- Reference 66SENSEONsenseon.comVisit source
- Reference 67BLACKPOINTCYBERblackpointcyber.comVisit source
- Reference 68IDTHEFTCENTERidtheftcenter.orgVisit source
- Reference 69HHShhs.govVisit source
- Reference 70CISAcisa.govVisit source
- Reference 71BAKERLAWbakerlaw.comVisit source
- Reference 72QUALTRICSqualtrics.comVisit source
- Reference 73DELOITTEwww2.deloitte.comVisit source
- Reference 74CNILcnil.frVisit source
- Reference 75EVENTUSeventus.comVisit source
- Reference 76COFENSEcofense.comVisit source
- Reference 77SECURITYsecurity.googleblog.comVisit source
- Reference 78TERRANOVASECURITYterranovasecurity.comVisit source
- Reference 79NEUSCHNEEneuschnee.comVisit source
- Reference 80IDCidc.comVisit source
- Reference 81FSISACfsisac.comVisit source
- Reference 82OKTAokta.comVisit source