Short Message Service (SMS) Phishing Attacks and Defenses: A Systematic Review

2026-04-13

AI Summary

Smishing attacks are becoming increasingly sophisticated, yet the existing literature lacks a systematic review. This study presents the first comprehensive systematic literature review of the smishing domain, synthesizing interdisciplinary research across four key dimensions: user perception and susceptibility, attack characteristic modeling, defense mechanisms, and datasets. By consolidating current knowledge on offensive and defensive strategies, the work not only maps the state of the art but also identifies critical research gaps. Furthermore, it offers theoretical foundations and actionable guidance for future efforts in designing detection systems, developing robust data resources, and formulating effective security policies.

Technology Category

• Cognitive Modeling & Cognitive Systems: Social Cognition And Interaction
• Application Domains: Humanities & Computational Social Science
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

SMS Phishing (also known as 'smishing') is a growing deceptive social engineering (SE) attack that leverages mobile SMS to conduct cybercrimes such as stealing sensitive information or spreading malware by tricking users into interacting with attackers' messages (e.g., responding to or clicking URLs). This threat has increased rapidly in recent years, causing $470M in financial losses for United States users in 2024 alone. This threat is also evolving rapidly, meaning that attackers continually adapt their tactics, reshaping the landscape. There is a significant body of literature on investigating smishing attacks and defenses. However, there is no systematic review that reflects the current attack and defense landscape along with available resources (i.e., relevant datasets). This motivates us to systematize the current smishing research efforts, including the following four research pillars: (a) user perception and susceptibility, (b) attack characterization, (c) defense landscape, and (d) smishing datasets. This leads us to propose novel future research directions towards effectively mitigating smishing attacks.

Problem

• SMS Phishing
• smishing
• systematic review
• social engineering
• cybersecurity

Innovation

• smishing
• systematic review
• social engineering
• cyber defense
• SMS phishing