Smishing Attacks: A Survey and Taxonomy of Threats, Detection Methods and Mitigation Strategies

With the rise in mobile device usage and short message service (SMS), security concerns related to SMS phishing –also known as smishing– have become increasingly significant. Despite the growing number of survey studies on smishing, existing works often focus on isolated aspects such as detection techniques or user awareness, lacking a unified study from each stakeholder’s perspective. The primary objective of this paper is providing a comprehensive state-of-the-art survey for the smishing attacks by tracing the evolution of SMS systems and examining current efforts in performing, detecting and mitigating smishing attacks. Following a systematic survey methodology, various attack techniques, detection mechanisms, and their corresponding mitigation strategies are analyzed in depth. Based on this analysis, the paper introduces a taxonomy that categorizes smishing attacks and countermeasures across technical and human-centric dimensions. This analysis highlights both the challenges and opportunities associated with the unique weaknesses of the mobile telecommunication environment. The findings provide insights into how detection and mitigation strategies are coupled across different deployment layers and are preserved as a resource for the current state-of-the-art for smishing attacks and countermeasures to enable robust, scalable, multi-layered, and privacy-preserving solutions.