Short Message Service (SMS) Phishing Attacks and Defenses: A Systematic Review

• URL: http://arxiv.org/abs/2604.11429v1
• Date: Mon, 13 Apr 2026 13:16:54 GMT
• Title: Short Message Service (SMS) Phishing Attacks and Defenses: A Systematic Review
• Abstract summary: SMS Phishing (also known as'smishing') is a growing deceptive social engineering (SE) attack that leverages mobile SMS to conduct cybercrimes.<n>This threat has increased rapidly in recent years, causing $470M in financial losses for United States users in 2024 alone.<n>There is no systematic review that reflects the current attack and defense landscape along with available resources.
• Score: 6.069625030690955
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: SMS Phishing (also known as 'smishing') is a growing deceptive social engineering (SE) attack that leverages mobile SMS to conduct cybercrimes such as stealing sensitive information or spreading malware by tricking users into interacting with attackers' messages (e.g., responding to or clicking URLs). This threat has increased rapidly in recent years, causing $470M in financial losses for United States users in 2024 alone. This threat is also evolving rapidly, meaning that attackers continually adapt their tactics, reshaping the landscape. There is a significant body of literature on investigating smishing attacks and defenses. However, there is no systematic review that reflects the current attack and defense landscape along with available resources (i.e., relevant datasets). This motivates us to systematize the current smishing research efforts, including the following four research pillars: (a) user perception and susceptibility, (b) attack characterization, (c) defense landscape, and (d) smishing datasets. This leads us to propose novel future research directions towards effectively mitigating smishing attacks.

Related papers

• Techniques of Modern Attacks [51.56484100374058]
  Advanced Persistent Threats (APTs) represent a complex method of attack aimed at specific targets.<n>I will investigate both the attack life cycle and cutting-edge detection and defense strategies proposed in recent academic research.<n>I aim to highlight the strengths and limitations of each approach and propose more adaptive APT mitigation strategies.
  arXiv  Detail & Related papers  (2026-01-19T22:15:25Z)
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections [74.60337113759313]
  Current defenses against jailbreaks and prompt injections are typically evaluated against a static set of harmful attack strings.<n>We argue that this evaluation process is flawed. Instead, we should evaluate defenses against adaptive attackers who explicitly modify their attack strategy to counter a defense's design.
  arXiv  Detail & Related papers  (2025-10-10T05:51:04Z)
• Detection and Prevention of Smishing Attacks [0.0]
  This work presents a smishing detection model using a content-based analysis approach.<n>To address the challenge posed by slang, abbreviations, and short forms in text communication, the model normalizes these into standard forms.<n> Experimental results demonstrate the model effectiveness, achieving classification accuracies of 97.14% for smishing and 96.12% for ham messages.
  arXiv  Detail & Related papers  (2024-12-31T04:07:12Z)
• Smishing Dataset I: Phishing SMS Dataset from Smishtank.com [0.0]
  We present the community-sourced smishing datasets from the smishtank.com. In the contribution of our work, we provide a corpus of 1090 smishing samples that have been publicly submitted through the site.
  arXiv  Detail & Related papers  (2024-02-28T15:56:28Z)
• SENet: Visual Detection of Online Social Engineering Attack Campaigns [3.858859576352153]
  Social engineering (SE) aims at deceiving users into performing actions that may compromise their security and privacy. SEShield is a framework for in-browser detection of social engineering attacks.
  arXiv  Detail & Related papers  (2024-01-10T22:25:44Z)
• Targeted Attacks: Redefining Spear Phishing and Business Email Compromise [0.17175834535889653]
  Some rare, severely damaging email threats - known as spear phishing or Business Email Compromise - have emerged. We describe targeted-attack-detection techniques as well as social-engineering methods used by fraudsters. We present text-based attacks - with textual content as malicious payload - and compare non-targeted and targeted variants.
  arXiv  Detail & Related papers  (2023-09-25T14:21:59Z)
• Commercial Anti-Smishing Tools and Their Comparative Effectiveness Against Modern Threats [0.0]
  We developed a test bed for measuring the effectiveness of popular anti-smishing tools against fresh smishing attacks. Most anti-phishing apps and bulk messaging services didn't filter smishing messages beyond the carrier blocking. While carriers did not block any benign messages, they were only able to reach a 25-35% blocking rate for smishing messages.
  arXiv  Detail & Related papers  (2023-09-14T06:08:22Z)
• On the Security Risks of Knowledge Graph Reasoning [71.64027889145261]
  We systematize the security threats to KGR according to the adversary's objectives, knowledge, and attack vectors. We present ROAR, a new class of attacks that instantiate a variety of such threats. We explore potential countermeasures against ROAR, including filtering of potentially poisoning knowledge and training with adversarially augmented queries.
  arXiv  Detail & Related papers  (2023-05-03T18:47:42Z)
• Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attacks [76.35478518372692]
  We introduce epsilon-illusory, a novel form of adversarial attack on sequential decision-makers. Compared to existing attacks, we empirically find epsilon-illusory to be significantly harder to detect with automated methods. Our findings suggest the need for better anomaly detectors, as well as effective hardware- and system-level defenses.
  arXiv  Detail & Related papers  (2022-07-20T19:49:09Z)
• Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS [70.60975663021952]
  We study blackbox adversarial attacks on network classifiers. We argue that attacker-defender fixed points are themselves general-sum games with complex phase transitions. We show that a continual learning approach is required to study attacker-defender dynamics.
  arXiv  Detail & Related papers  (2021-11-23T23:42:16Z)
• A Targeted Attack on Black-Box Neural Machine Translation with Parallel Data Poisoning [60.826628282900955]
  We show that targeted attacks on black-box NMT systems are feasible, based on poisoning a small fraction of their parallel training data. We show that this attack can be realised practically via targeted corruption of web documents crawled to form the system's training data. Our results are alarming: even on the state-of-the-art systems trained with massive parallel data, the attacks are still successful (over 50% success rate) under surprisingly low poisoning budgets.
  arXiv  Detail & Related papers  (2020-11-02T01:52:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.