Key Takeaways
- Risk to your company: one tapped link can give a scammer a staff member's bank, email or WhatsApp login, and a fake 'boss' text can push a payment out of your account.
- Smishing is phishing by SMS: a text that pretends to be a bank, courier, government department or your own company to make you click, call or reply.
- Phishing made up about 61% of the 4,404 incidents HKCERT handled in Q3 2026.
- Most of the defence is habit: no action on links in texts, no sharing of codes, and a call-back rule for any money request.
- If you clicked, call your bank first, then the police Anti-Scam Helpline 18222, and change any password you typed.
A text says your parcel is stuck at customs and needs HK$18 to release. Another says your bank account will be frozen tonight. Both are smishing, and both work because a phone screen hides most of the clues you would notice on a computer.
What is smishing?
Smishing (SMS phishing) is a scam text message that impersonates a trusted sender, such as a bank, courier, government department, mobile operator or your employer, to make you open a link, call a number or reply with personal details, passwords, card numbers or one-time passcodes (OTPs). The name joins 'SMS' and 'phishing'.
Think of it as a forged notice slipped under your office door: it looks official, it asks you to act quickly, and the return address leads to the scammer.
Smishing is one branch of phishing, the wider family of impersonation attacks by email, SMS, chat apps and phone calls. The difference is the channel: a text arrives on the device you carry everywhere, often while you are busy, and short links hide where they really go.
How does a smishing attack work?
Most smishing follows five steps. The scammer collects phone numbers, sends a text that copies a familiar brand, adds urgency, sends you to a fake page or fake hotline, and then uses what you enter (passwords, card details or OTPs) within minutes to take over accounts or make payments.
A Hong Kong example: in mid-September 2026 police received more than 700 reports of credit cards used without permission to buy electronics, with losses of about HK$14.7 million. HKCERT's alert of 14 September 2026 lists fake SMS messages from banks, merchants and couriers among the likely ways the card details were collected.
The five steps
- Collect numbers: leaked customer lists, random dialling, or an SMS blaster (a fake mobile base station, often in a car, that pushes texts to every phone nearby).
- Impersonate: the sender name or wording copies a bank, courier, toll or utility company, government department or your own company.
- Create urgency: a frozen account, failed delivery, unpaid fee, refund or prize with a deadline.
- Capture: a look-alike login page, a fake customer-service number, or a request to forward a verification code.
- Cash out: card transactions, bank transfers, or takeover of email, WhatsApp or social media accounts that are then used to scam your contacts.
What types of smishing are common in Hong Kong?
The common types are delivery or customs fee texts, bank and card security alerts, fake government or utility bills, refund and reward offers, fake police messages, account verification texts for WhatsApp or social media, and texts that pretend to come from your boss or a colleague. Each one aims at a different prize.
| Type | Typical message | What the scammer wants |
|---|---|---|
| Delivery fee | Your parcel is on hold. Pay HK$18 to redeliver. | Card number and OTP |
| Bank or card alert | Unusual login detected. Verify now or your account will be suspended. | Online banking login |
| Government or utility bill | Your bill is overdue (HKCERT warned of fake Water Supplies Department bills in March 2026). | Card details |
| Refund or reward | You have unclaimed points or a tax refund. | Card details |
| Fake police or authority | Texts posing as police about recovered money (ADCC alert). | Personal and bank details |
| Account verification | Enter the code we sent to keep your account active. | WhatsApp or social media takeover |
| Boss or colleague | New number. I'm in a meeting, please transfer the deposit now. | A company payment |
Three delivery routes, not one
- Normal SMS: sent through mobile networks from SIM cards or bulk-SMS services. This is the most common route.
- SMS blasters: a fake base station forces nearby phones down to the old 2G standard, which does not make the phone check that the network is genuine, then pushes texts with any sender name. Hong Kong police have made several arrests of drivers carrying these devices since February 2025, according to Commsrisk.
- Look-alike chat messages: iMessage or RCS chats from overseas numbers or email addresses that look like SMS but can skip operator filters.
How can you spot a smishing text?
Treat any text as suspicious if it asks you to click a link, call a number, reply with a code or pay a small fee, especially with a deadline. Then check the sender: in Hong Kong many registered organisations send SMS with a '#' prefix, so a 'bank' text without one deserves extra doubt.
- No '#' in the sender: under OFCA's SMS Sender Registration Scheme, registered senders use IDs that start with '#'. Joining is voluntary, so a missing '#' is a warning sign, not proof.
- A link that is close to the real one: extra letters, hyphens, unusual endings such as .top or .xyz, or a URL shortener.
- A tiny fee: HK$10 to HK$30 to 'redeliver' a parcel exists only to collect your card number.
- A request for a code: no bank, courier or app needs you to forward an OTP.
- Pressure: 'within 24 hours', 'today only', 'account will be suspended'.
- A local brand texting from an overseas number or an email address.
- A padlock is not proof: HKCERT notes that HTTPS only means the connection is encrypted, not that the site is genuine.
The HKMA has repeatedly reminded the public that banks will not send SMS or emails with embedded links that lead to their websites for transactions. If you are unsure about a link, number or account, check it on the police tool Scameter before you do anything else.
How do you protect yourself and your company from smishing?
Individuals should turn on the phone's spam filtering, never sign in or pay through a link in a text, and check doubtful links on Scameter. Companies should add one rule (any payment or bank-detail change requested by message is confirmed by phone on a known number) and train staff to report suspicious texts.
For individuals: phone settings (menu names last reviewed November 2026; they vary by phone model and system version)
- iPhone, filter unknown senders (iOS 26): Settings → Apps → Messages → Screen Unknown Senders → On. On earlier versions the switch is called Filter Unknown Senders.
- iPhone, report a text: open the message → tap Report Junk under it → Delete and Report Junk.
- iPhone, block 2G against SMS blasters: Settings → Privacy & Security → Lockdown Mode → Turn On. Use it only if you are a likely target, because it also limits other features.
- Android, spam filter (Google Messages): open Messages → tap your profile picture → Messages settings → Spam protection → Enable spam protection → On.
- Android, block 2G: on Pixel and many Android 12+ phones, Settings → Network & internet → SIMs → Allow 2G → Off. On Samsung, Settings → Connections → Mobile networks → Allow 2G service → Off.
For SMEs and IT teams
- Write a payment rule: any request to pay, change bank details or buy gift cards that arrives by SMS, WhatsApp or email is confirmed by calling the requester on a number already on file.
- Register your own sender ID with OFCA if you text customers, and tell customers you never send payment links.
- Use phishing-resistant sign-in such as passkeys or authenticator apps for email and banking, so a stolen password or SMS code is not enough.
- Run short phishing drills that include SMS, and give staff one place to report a suspicious text.
- Turn on real-time transaction alerts and daily limits for company cards and bank accounts.
Company scenario: the 'boss' text at 5:40 pm
Picture a 20-person trading company in Kwun Tong. At 5:40 pm the accounts clerk receives a text: 'It's Mr Chan, new phone. The supplier needs the deposit before 6. Please send it to this account, I'll explain tomorrow.' The tone fits, the deadline is real, and the boss is known to be at a client dinner. Without a rule, the clerk must choose between annoying the boss and risking HK$80,000. With a rule, the decision is already made: no transfer until the clerk reaches Mr Chan on the number saved in the company contact list. Write that rule down and tell every person who can move money.
Staff notice to copy into your WhatsApp group
Office reminder: scam texts are rising (HKCERT: phishing was 61% of incidents in Q3 2026).
1. Do not tap links in texts about parcels, bank alerts, bills or refunds. Open the official app instead.
2. Never share a verification code (OTP) with anyone, even 'the bank'.
3. Any payment or bank-detail change requested by text: call the person on the number we have on file first.
4. Not sure? Check it on Scameter (cyberdefender.hk) or ask IT before you act.What should you do if you clicked a smishing link?
Act within minutes. If you entered payment details, call your bank to freeze the card or account. Change any password you typed and sign out other sessions. Then call the police Anti-Scam Helpline 18222 or report at a police station, report the link to HKCERT, and tell IT if a work device or account is involved.
- Entered card or banking details: call the bank on the number printed on your card, freeze the card and ask about recent transactions.
- Typed a password: change it from a device you trust, turn on two-step sign-in and sign out all other sessions.
- Shared a WhatsApp or app code: start account recovery at once; see our guide to WhatsApp hijacking.
- Installed an app from a link: switch the phone to flight mode, remove the app and ask IT to check or reset the device.
- Get help: call 18222 (24 hours, Anti-Deception Coordination Centre) and report to police if money was lost. Report the link to HKCERT or call its 24-hour hotline 8105 6060.
- Personal data at risk: if customer or staff data may have leaked from a company account, assess whether to notify the Office of the Privacy Commissioner for Personal Data (PCPD).
- Keep evidence: screenshots of the text, the link and any transaction records.
What is the difference between smishing, phishing and WhatsApp hijacking?
Phishing is the umbrella term for impersonation scams that steal logins or money. Smishing is phishing delivered by text message. WhatsApp hijacking is one possible result: scammers take over your WhatsApp account, often after tricking you into sharing a verification code or scanning a QR code, and that can start with a smishing text.
| Item | Phishing | Smishing | WhatsApp hijacking |
|---|---|---|---|
| Channel | Email, SMS, chat apps, phone, fake websites | SMS and look-alike chat messages | Your WhatsApp account |
| Goal | Logins, money or malware | The same, through a text | Control of your account to scam your contacts |
| Main defence | Verify before you act | Spam filter, no links in texts, '#' sender check | Two-step verification, review linked devices |
What is the latest smishing situation in Hong Kong (updated November 2026)?
HKCERT handled 4,404 security incidents in Q3 2026, about 15% more than a year earlier, and 2,672 of them, about 61%, were phishing. Social media and messaging apps were the most impersonated targets at about 46%, followed by banking, financial services and e-payment at about 21%.
Source: HKCERT Q3 2026 statistics, released 5 November 2026.
- September 2026: more than 700 police reports of unauthorised card use, with losses of about HK$14.7 million; HKCERT lists fake SMS among the likely sources of the card data (HKCERT alert, 14 September 2026).
- August 2026: after a Hong Kong online shopping platform reported a breach that may affect about 33,000 people, police received six fake customer-service scam cases within a week, with losses above HK$300,000 (reported in HKCERT's Q3 2026 review).
- July 2026: police arrested drivers carrying SMS blasters in Sheung Shui and Tseung Kwan O; one device had sent more than 1,000 scam texts (Commsrisk, July 2026).
The best defence is a habit, not an app
Smishing works because a text feels personal and urgent, and a phone screen hides the details. You do not need to spot every fake. You need three habits: never act on a link in a text, never share a code, and confirm any money request by calling a number you already have. Put those into a written company rule, share the staff notice above, and go through the checklist below with your team this week.
60-second self-check
- Spam filtering is on (iPhone: Screen Unknown Senders; Android: Spam protection).
- Bank and card apps send real-time transaction alerts.
- Email, banking and WhatsApp use two-step verification or passkeys.
- Everyone who can pay has a written 'call back before paying' rule.
- Staff know to check doubtful links on Scameter and to call 18222 if they clicked.
Find out how your team handles a scam text
A phishing simulation shows which staff would click, call or reply, without a real loss. UD Security runs SMS and email tests based on scams seen in Hong Kong, then trains staff on exactly what they missed.
Frequently Asked Questions
Is it safe to open a smishing text without clicking the link?
Generally yes. Reading a plain SMS does not infect a phone. The risk starts when you tap the link, call the number, reply or install something, so delete the text and report it as junk.
Do Hong Kong banks send links by SMS?
The HKMA has repeatedly reminded the public that banks will not send SMS or emails with embedded links that lead to their websites for transactions. Open your bank's app or type its address yourself.
What does the '#' in front of an SMS sender mean?
It shows the sender has registered its ID with OFCA under the SMS Sender Registration Scheme, launched in December 2023. Joining is voluntary, so treat '#' as a good sign, not a guarantee, and still avoid links.
Can an SMS blaster reach my phone if I use 5G?
It can try. The device pushes nearby phones down to 2G, which does not check that the network is genuine. Turning off 2G on Android, or Lockdown Mode on iPhone, reduces the risk.
Will my bank refund money lost to smishing?
It depends on the bank's terms and whether the transaction counts as authorised by you. Report to the bank and the police immediately, because fast reporting improves the chance of stopping or recovering a payment.