The phishing channel your SOC cannot see
Email phishing passes through your gateway, your logs and your sandbox. SMS phishing (smishing) lands on an employee's personal phone, renders a link in a messaging app with almost no URL visible, and opens in a mobile browser your EDR does not cover. The first time the SOC hears about it is when someone forwards a screenshot, or when a credential shows up in a login from an unfamiliar country.
That makes smishing investigation unusual: you work from screenshots and user reports, the infrastructure is short-lived, and the most useful action is often reporting to carriers rather than blocking anything yourself.
Anatomy of a smishing message
From: +44 7700 900123
LaPoste: votre colis est en attente. Frais de 1,99 EUR à régler
sous 24h : hxxps://bit[.]ly/3xYzAbc
(The number is from Ofcom's range reserved for drama and documentation, the lure is a composite.)
Four things to extract every time:
- The sender: a phone number, a short code, or an alphanumeric sender ID.
- The lure: parcel fees, toll or fine payments, tax refunds, bank security alerts, "Hi mum, new number", job offers. Lures cluster by campaign and season.
- The link: often shortened, sometimes a bare domain with a lookalike name.
- Metadata: time received, recipient number, whether it arrived as SMS, RCS or iMessage. Ask the user for a screenshot that includes the sender line and timestamp.
Reading the sender
Number type matters more than number
Normalise to E.164 (+33612345678, +447700900123) and identify the type before anything else. Look it up on /phone/ for format validation, country and line type.
| Type | Typical use in smishing | What it suggests |
|---|---|---|
| Mobile (real SIM) | Mass sending from SIM farms or compromised devices | Prepaid SIMs burned per campaign; carrier can disconnect |
| VoIP / virtual | "Call us back" lures, OTP interception, conversational scams | Cheap and disposable; provider abuse desk is the lever |
| Landline | Rare for SMS, common in vishing callbacks | Often spoofed rather than owned |
| Short code (4 to 6 digits) | Legitimate bulk senders, banks, carriers | Rarely spoofable domestically; a scam from a short code is unusual |
Alphanumeric sender ID (LaPoste, HMRC) |
Brand impersonation | Not authenticated in many networks; can thread into the real brand's conversation |
| Foreign number | International SIM farms, roaming SIMs | Mismatch with the claimed brand's country is itself a signal |
Alphanumeric sender IDs are the nastiest trick. In many countries a sender can choose any name of up to 11 characters. The fake "LaPoste" message then appears in the same thread as genuine La Poste messages on the victim's phone. Some markets run sender ID registries (the UK has the SMS SenderID Protection Registry), but coverage is incomplete.
Carrier and portability
A carrier lookup tells you which operator a number was originally allocated to, and live lookups (HLR) can tell you the current network and whether the number is active. Two cautions:
- Number portability means the prefix-based "original carrier" is often wrong. Prefer live data where you can get it lawfully.
- Active today, dead tomorrow. Smishing SIMs are disposable. Record what you saw and when, because the lookup will look different next week.
Other delivery paths
Not every smishing message travels through a carrier's SMS core. Phishing-as-a-service platforms (Darcula and the operators reported as "Smishing Triad" are well documented examples) send through iMessage and RCS using fleets of accounts, which bypasses carrier SMS filtering. Police in several European countries have also seized SMS blasters: fake base stations in cars that push messages directly to nearby phones. In both cases the "sender number" is close to meaningless, and the link is your best pivot.
Unwrapping the link
The link is where the campaign is. Handle it carefully.
Do not open smishing links on a corporate or personal phone. Many kits only serve the phishing page to mobile user agents from the target country and redirect everyone else to a harmless site. Use an isolated scanner or a sandboxed mobile emulation with the right geolocation, never the user's device.
- Defang and record the exact string from the screenshot. Typos in OCR or retyping send you to a different site.
- Expand shorteners without visiting the target. Most shorteners offer a preview mode, and a scanner can follow redirects server side. Expect chains: shortener, redirector, cloaking page, kit.
- Analyse the final URL on /url: decoded punycode form, embedded redirects, path patterns. Then pivot to the domain on /domain/ for age, registrar and hosting. Smishing domains are usually days old.
- Look for kit fingerprints. Path structures, parameter names and favicon hashes repeat across a kit's deployments, and are more durable than domains.
- Check for siblings. Same IP, same name server, same naming pattern (
laposte-frais-*,*-toll-pay[.]com). Our passive DNS guide covers the pivot, and lookalike domains covers the naming tricks.
Assess the impact
For each user who reported or clicked:
- Did they enter anything? Credentials, card details, OTP codes, or personal data. Each implies a different response: password reset and session revocation, bank notification, identity monitoring.
- Is it corporate or personal? A fake "IT helpdesk" SMS asking for an MFA code is a targeted attack on your organisation. A parcel lure on a personal phone is opportunistic, but the user may still have reused a work password.
- Was the number targeted? If several employees received the same lure on work numbers, the attacker has a list. Ask where those numbers are published.
- Check identity logs for sign-ins from new devices or locations around the click time, especially MFA approvals.
Track it all in one case (see /cases) with screenshots, normalised numbers, URLs, domains and UTC timestamps.
Reporting: the channels that actually disrupt campaigns
Reporting is the step most SOCs skip, and it is where smishing gets stopped at scale. Carriers aggregate reports to block senders and URLs network wide.
| Country | Channel | How |
|---|---|---|
| France | 33700 | Forward the SMS to 33700, then reply with the sender's number when asked. Also available on the 33700.fr site. |
| France | cybermalveillance.gouv.fr | Victim assistance and guidance; file a police complaint if money was lost |
| United Kingdom | 7726 | Forward the SMS to 7726 (spells SPAM on a keypad), free on major networks; you are then asked for the sender number |
| United Kingdom | National fraud reporting service | If money or data was lost |
| United States | 7726 | Supported by major US carriers too |
| Anywhere | Shortener and registrar abuse desks | Report the short link and the final domain with evidence |
| Anywhere | Impersonated brand | Most banks, postal and parcel operators run a phishing report address |
Make reporting a one-line instruction. Put "forward suspicious SMS to 33700 (FR) or 7726 (UK), then send a screenshot to the SOC" in your awareness material. Users will not remember a process; they will remember a number.
What to do Monday
- Give employees one place to send smishing screenshots, and teach the 33700 / 7726 forward.
- Build a short intake template: sender (E.164 or sender ID), full message text, link, time, recipient number, clicked or not.
- Normalise and look up every number, but pivot mainly on the link and domain.
- Expand shorteners and fetch pages only from isolated, geo-appropriate scanners.
- For any click, check identity logs and reset credentials quickly; for any payment, the user calls their bank first.
- Report to carriers, shorteners and registrars every time. Reports compound; silence does not.
