Phishing is a message that impersonates an organisation to get you onto a fake login page or a payment form. Smishing is the same thing by text. The message usually invents a small, plausible problem — a parcel, a toll, a rejected payment. US complaints have fallen since 2023 while reported losses rose roughly elevenfold.
Phishing is a message pretending to be from an organisation you deal with, designed to get you onto a page that is not theirs. Smishing is the same thing delivered by text; vishing is the version done by voice.
The genre has a house style, and it is worth naming because it is remarkably consistent: a small, cheap problem with a link that fixes it. A parcel could not be delivered — confirm your address. An unpaid toll of £2.40 — settle it now. A payment was declined. A subscription is expiring. Your bank noticed unusual activity.
None of these are frightening enough to make you stop and think, and all of them are annoying enough that you want them dealt with. That is deliberate. Alarm makes people call someone; mild irritation makes them click.
The shape of the crime is changing sharply. US complaints fell from 298,878 in 2023 to 191,561 in 2025, while reported losses rose from $18.7 million to $215.8 million — roughly elevenfold. Average loss per complaint went from about $63 to about $1,127. Fewer people are being reached, and what reaches them is far more expensive.
A parcel, a toll, a declined payment, a password expiring, an unexpected invoice. Calibrated to be plausible and mildly annoying rather than alarming.
On a phone screen, the real destination of a link is largely hidden. A QR code hides it completely — which is why quishing works, and why stickers placed over genuine codes on parking meters have become a common physical variant.
Not merely a lookalike. Modern phishing kits proxy the genuine site in real time, so the page responds exactly as the real one would — because in a sense it is the real one, viewed through somebody else’s window.
Having taken the password, the page asks for the one-time code, and relays it to the real site while you wait.
Where it could have stopped
A code entered on a page you reached from a message is handed straight to whoever sent the message. This is why two-factor authentication does not save you here. The defence is the route, not the inspection: reach your account through your own app or a bookmark, and the fake page never gets the chance.
Either the account is taken over, or the page simply captures a card directly through a small “redelivery fee” or “toll charge” — an amount low enough not to trigger a second thought.
Frequently the most expensive part. A “fraud team” rings about the suspicious login you just made, and the safe account script begins. The phishing page was the groundwork.
The premise is nearly always true. You are expecting a parcel. You did drive on a toll road. You do have subscriptions. The message does not need to be believed so much as to be unremarkable.
Phone screens hide the evidence. The URL is truncated, the sender is a name rather than an address, and the whole interaction happens in a few seconds while you are doing something else.
Sender IDs can be spoofed into real threads. A scam text can appear directly beneath genuine messages from your bank, which defeats one of the few checks people actually perform.
The clones are no longer detectably fake. The advice to “look for spelling mistakes” describes a generation of phishing that filters now catch. What survives is proxied, correctly branded, and responds like the real site.
Codes feel protective right up to the moment they are not. People have been trained that a code means security. Very few have been told that entering one on the wrong page hands over the account.
And the amounts are small. A £2.40 toll or a $3 redelivery fee is beneath the threshold at which anyone investigates — which is the point, because the card details are the product, not the payment.
Phishing has the least meaningful geography of anything on this site, because it needs no local presence at all: a domain, a template kit and a list. Kits are sold as a service, complete with hosting, and the same template appears simultaneously against banks on three continents.
The enforcement record does show clustering. Large-scale smishing infrastructure aimed at Western countries has been repeatedly attributed to Chinese-language criminal groups operating subscription phishing platforms, particularly for the toll, delivery and postal variants. West African networks feature heavily in the business email compromise pipeline that begins with a phished mailbox. Russian-speaking groups dominate the credential-access market, selling harvested logins rather than using them.
The most notable current development is technical rather than geographic. The FBI’s September 2026 advisory describes OAuth consent phishing — obtaining a permission token rather than a password, so that access survives a password change and can only be ended by revoking the token in account settings. There is no fake login page involved at all.
On 3 September 2026 the FTC warned consumers that people have reported scammers covering up legitimate QR codes on parking meters with codes of their own. Scanning the substituted code leads to a fake site built to take payment details, personal information, or both. It is the physical version of a phishing link, and it defeats every habit people have learned about checking where a link goes.
In September 2026 the FBI warned about OAuth consent phishing — a technique that obtains lasting access to an account without ever taking a password. The victim is sent a link that asks them to approve an application, and the resulting token cannot be cancelled by changing the password. Since late 2025 the FBI has observed actors impersonating government officials, media figures and event organisers on messaging apps to deliver these requests.
In August 2026 the FBI warned that sexual exploitation actors are illegally accessing victims' social media and personal accounts to steal explicit content and sell it on criminal marketplaces — often without the victim ever knowing. The intrusion methods are ordinary account-takeover techniques, including one that turns on persuading the victim to hand over a verification code.
In May 2025 an Alabama man was sentenced to 14 months in prison for his part in taking over the US Securities and Exchange Commission's account on X. He obtained control by performing a SIM swap: using a printer to make a fraudulent identification card from a victim's stolen personal details, impersonating that person at a mobile carrier, and taking over their phone number. Co-conspirators then posted a false announcement in the SEC chairman's name that moved the price of bitcoin by more than $1,000 within minutes.
The FTC publishes a Medicare Open Enrollment warning every autumn, and the 30 September 2025 edition contains the single most useful sentence in the whole category: real Medicare cards are free and mailed automatically. Anybody who calls offering a new or updated one, and asks for a number to process it, has identified themselves.
In April 2025 the FTC published its analysis of 2024 text-message fraud reports and placed the "wrong number" opener fifth among the top five text scams — the only one of the five with no pretext at all. The same analysis records $470 million lost to text-initiated fraud in 2024, more than five times the 2020 figure, and a doubling in the share of text scam reports that involved actual money lost.
US phishing and spoofing complaints fell from 298,878 in 2023 to 191,561 in 2025, while reported losses rose from $18.7 million to $215.8 million — roughly eleven times. Australia saw the same divergence in a single year: Scamwatch phishing reports fell 33.2%, while combined national phishing losses rose 15.5%. Phishing is becoming a smaller, far more expensive crime.
Australian text-message scam reports fell from 77,365 in 2024 to 29,058 in 2025 — a 62.4% collapse that the National Anti-Scam Centre attributes to disruption across the ecosystem. Losses through the same channel went the other way, rising from A$14.0 million to A$17.9 million, driven by high-value losses in job, investment and phishing scams. Blocking is working on volume and not on harm.
US consumers filed 141,902 unwanted telemarketing complaints with the FTC in 2024, alongside 200,331 about unsolicited email and 164,634 about unsolicited texts. None of those figures measures the robocall problem, and the reason is instructive: one operation alone made five billion calls in a quarter that produced nothing like five billion complaints.
In December 2024 the FBI published an itemised account of how criminals use generative AI across text, images, audio and video. The most consequential entries are the mundane ones: AI used to correct grammar and spelling for foreign actors targeting US victims, to produce fictitious social media profiles at volume, and to generate the content of fraudulent investment websites.
In December 2022 the FCC proposed a $299,997,000 penalty — the largest in its history — against the auto warranty robocall operation, having found it placed approximately 5.19 billion calls to over 550 million phones in three months using more than a million spoofed caller IDs. Enough to have called every person in America fifteen times.
If you clicked but entered nothing. You are almost certainly fine. Close the page and do not return to it. If what you saw was an app-permission screen rather than a login form, check your account’s connected-applications list and revoke anything unfamiliar — a password change will not remove that kind of access.
If you entered credentials.
If you entered card details. Call your bank now and cancel the card. The small charge was the smallest part of it — the details are the product.
Reporting. Forward scam texts free to 7726 in the UK, Australia, Canada and several other countries. Forward scam emails to [email protected] in the UK. Report the wider incident through your national agency — see where to report.
Preventing it. One habit and one setting.
The habit: never reach an account through a link. Use your own app or bookmark, every time, even when the message is genuine. It costs ten seconds and it makes the entire category ineffective.
The setting: use passkeys or a hardware security key wherever they are offered. Unlike codes, they are bound to the real domain and simply will not work on a fake one — the only widely available control that defeats real-time proxying.
Phishing rarely takes money directly. It takes access, and access is a commodity.
Harvested credentials are sold in bulk, and buyers use them for different things: draining accounts, running business email compromise from a compromised mailbox, opening credit, or reselling to whoever needs a foothold. The person who phished you is very often not the person who eventually uses it.
Where a payment is captured directly — the small redelivery or toll fee — the card details are the real prize. The charge itself is a test; the details are tested, sold and used elsewhere, which is why a trivial fraudulent charge is worth treating as seriously as a large one.
The other half of this story
Our sibling site Clean on Paper explains where the harvested accounts get used — how compromised accounts become laundering infrastructure rather than just a theft.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
Increasingly you cannot, and that is the honest answer. Modern phishing kits proxy the genuine site in real time, so everything behaves correctly. The reliable defence is not inspection but route: reach your account through your own app or bookmark rather than through any link, and the question never arises.
Not against this. If you enter a code on a phishing page, the kit relays it to the real site while you wait and gets in. Passkeys and hardware security keys do protect you, because they are bound to the real domain and simply will not work on a fake one.
Yes, and it is one of the best signals available. Password managers match on the exact domain, so silence on a page that looks like your bank is the manager telling you the domain is wrong. Treat that as a stop, not as a glitch to work around by copying and pasting.
Sender IDs can be spoofed, which makes scam texts appear inside a legitimate thread. Thread position tells you nothing about who sent a message. It is one of the most convincing tricks in this category precisely because it defeats a sensible-seeming check.
Usually not. Most phishing needs you to type something. Close the page, do not return to it, and if it was an app-permission request rather than a login page, check your account's connected-applications list and revoke anything unfamiliar.
Filtering has improved, so the crude mass version reaches fewer people and gets reported less. What survives the filters is targeted and far more expensive when it lands. In Australia only 2.3% of people who reported a phishing scam had lost any money at all, while national phishing losses still rose.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.