The Most Spoofed Brands in SMS Phishing: Protect Your Business in 2025

Spam text messages often impersonate trusted brands like Amazon, Microsoft, or major banks. These SMS phishing (smishing) scams exploit the trust people place in familiar names to steal sensitive information.

The impact of these attacks is alarming. Victims often face financial losses, stolen identities, and exposure to confidential business data. Cybercriminals craft convincing messages, such as fake delivery updates or urgent account alerts, to trick users into clicking malicious links or providing personal details.

This blog will uncover the most commonly spoofed brands in SMS phishing attacks, explain why these brands are targeted, and provide steps businesses can take to protect themselves from these growing threats.

What is SMS Phishing (Smishing)?

Smishing is a type of phishing scam delivered through SMS messages. These messages often impersonate trusted brands, misleading recipients into clicking malicious links or sharing sensitive information like passwords or financial details.

To learn more about how smishing operates, check out our guide on what smishing is and how to protect yourself against it.

Why Cybercriminals Target Specific Brands for SMS Phishing Attacks

Cybercriminals don’t choose brands randomly. Their targets are strategic:

Table 1: Key Reasons Cybercriminals Target Specific Brands for SMS Phishing

The Most Spoofed Brands in SMS Phishing Attacks

Cybercriminals carefully select trusted brands for SMS phishing (smishing) campaigns to exploit their familiarity, credibility, and frequent interactions with users. These brands are not chosen at random, hackers target them because they are widely recognized, and people often receive legitimate messages from them. This increases the chances of a victim trusting and interacting with a fake message. Let’s break down the most impersonated brands, why they are targeted, and the tactics hackers use.

According to Keepnet, the following brands were the most impersonated in smishing attempts:

Amazon

Amazon leads the list with 38% of smishing attempts. The company’s massive global customer base and frequent transactional communications make it a prime target for cybercriminals. Hackers exploit legitimate-looking notifications, such as:

• Order Confirmations: “Your order could not be processed. Click here to update your payment details.”
• Shipping Updates: “Your package is delayed. Track it here.”

These messages prey on users' expectations of regular updates, making the fake links appear credible. Once clicked, victims are redirected to malicious websites that steal personal or payment information.

Apple

Apple accounts for 17% of smishing attacks, reflecting its strong association with user accounts, passwords, and financial data. Apple’s ecosystem, including iCloud, Apple Pay, and App Store, stores sensitive personal details, making it a lucrative target for hackers. Common smishing tactics include:

• Fake Account Alerts: “Your Apple ID has been locked due to suspicious activity. Verify here.”
• Password Reset Requests: “We’ve detected an unauthorized login. Reset your password now.”

These messages direct users to convincing phishing sites mimicking Apple’s secure login pages, where credentials are harvested.

HMRC (UK Tax Authority):

HMRC is impersonated in 15% of smishing attempts, making it one of the most spoofed government entities. Hackers rely on the fear and urgency associated with tax-related communications to manipulate victims. Common smishing schemes include:

• Refund Notifications: “You are eligible for a £500 tax refund. Claim it here.”
• Payment Warnings: “Your tax payment is overdue. Pay now to avoid penalties.”

The sense of urgency drives victims to click malicious links leading to fake payment portals designed to steal financial information or infect devices with malware.

PayPal

PayPal is targeted in 12% of smishing attempts due to its role in facilitating online payments and storing sensitive financial details. Hackers exploit the high volume of legitimate account alerts PayPal users receive. Typical smishing messages include:

• Transaction Alerts: “Unusual activity detected. Confirm this transaction here.”
• Account Verification Requests: “Your account has been restricted. Verify your identity now.”

These messages often direct recipients to fake PayPal login pages where hackers steal credentials and gain access to their accounts.

USPS

With 11% of smishing attacks, USPS scams are especially effective due to the high volume of e-commerce and package deliveries. Hackers exploit users’ reliance on tracking updates and delivery notifications by sending messages like:

• Delivery Issues: “Your package could not be delivered. Update your address here.”
• Shipping Fee Notices: “Additional postage is required to release your package. Pay here.”

The fraudulent links redirect victims to phishing sites that steal payment information or personal details.

FedEx

FedEx-related smishing makes up 7% of attacks, often targeting users during peak shipping seasons like holidays. These scams mimic FedEx’s legitimate delivery notifications to trick recipients into clicking malicious links. Common examples include:

• Tracking Updates: “Your package is out for delivery. Track it here.”
• Undelivered Packages: “We couldn’t deliver your package. Confirm your address now.”

Hackers leverage the widespread use of FedEx for online shopping deliveries, creating urgency to engage with the scam.

Netflix

Netflix is targeted in 5% of smishing campaigns. Hackers exploit the platform’s subscription-based model, where disruptions to account access or payment processing can cause immediate concern. Smishing messages typically include:

• Payment Issues: “Your subscription payment failed. Update your billing information now.”
• Account Suspension: “Your account has been suspended. Reactivate it here.”

Victims are led to fraudulent login or payment pages where hackers steal credentials or financial data. See our smishing statistics research to learn more about smishing facts and trends.

Why Hackers Target These Brands in Smishing Attacks

Hackers target these brands in smishing attacks because they exploit specific characteristics that make their scams convincing and effective:

1. Global Trust and Familiarity

Brands like Amazon, Apple, and Netflix are globally recognized and widely trusted. Users are less likely to question messages from these companies, assuming they are legitimate because of their reputation.

2. Frequent and Expected SMS Communication

Brands such as Amazon, FedEx, and USPS often send legitimate SMS notifications for orders, deliveries, or account updates. Hackers exploit this by mimicking real messages, making fake ones appear normal and trustworthy.

3. Access to Sensitive Financial Information

Brands like PayPal and Apple are closely tied to payments and personal data. Smishing messages often claim issues like unauthorized transactions or account suspension, prompting users to share login details or financial information.

4. Creating a Sense of Urgency or Fear

Hackers use urgency to pressure victims. Messages like “Your tax refund is waiting” (HMRC) or “Your package is undeliverable” (FedEx, USPS) push users to act quickly without questioning the message’s authenticity.

By leveraging trust, routine interactions, and emotional triggers, these smishing campaigns become highly persuasive, leading to higher success rates for hackers.

Real-World Consequences of Spoofing in SMS Phishing

In August 2022, Twilio, a company providing SMS services, was targeted in a smishing attack using brand spoofing. Cybercriminals posed as Okta, a trusted IT provider, and sent fake text messages to Twilio employees.

The messages claimed their sessions had expired and included a link to a fake login page that looked exactly like Okta’s real site. At least one employee entered their credentials, giving the attackers access to sensitive customer data, including addresses, payment details, and email information.

The breach went unnoticed for four days, allowing attackers to steal a large amount of data. Twilio later worked with mobile providers to block the malicious links. This attack shows how brand spoofing can trick even tech-savvy organizations.

Learn how to prevent spoofing attacks on our blog post: Understanding and Preventing Spoofing in Cybersecurity

How to Protect Your Organization Against SMS Phishing Attacks

Defending against SMS phishing requires a combination of employee awareness, practical testing, and secure communication practices. Here’s how your organization can stay protected:

1. Employee Training

Train employees to recognize and respond to smishing attempts. Use tools like Security Awareness Training to educate staff on spotting fake messages, malicious links, and impersonation tactics. Regular training builds a vigilant and informed workforce.

2. Simulation Tools

Evaluate your organization’s readiness with realistic phishing tests. Tools like the Phishing Simulator and Smishing Simulator allow you to replicate real-world attacks and identify vulnerabilities in employee responses.

3. Secure Practices for Consumers and Employees

• Always verify suspicious messages by contacting the brand or service provider directly through official channels.
• Avoid clicking on unverified links or providing sensitive information, such as login credentials or financial details, via SMS.
• Report smishing attempts to your IT department or security team to take immediate action.

To learn more about how to secure your business against Smishing statistics.

Minimize Smishing Risks with Keepnet

Keepnet’s platform for human risk management and secure behaviour management provides organizations with advanced tools to effectively combat smishing and brand spoofing, equipping teams with the skills and insights needed to mitigate risks.

Editor's Note: This article was updated on March 12, 2026.

Smishing Simulator with Spoofed Brand Templates

The Smishing Simulator enables organizations to test employee responses using realistic templates based on commonly spoofed brands like Amazon, PayPal, and Apple. These scenarios improve employees' ability to detect and avoid smishing attacks. See example smishing templates you can use for security awareness training:

Unlike generic training programs, Keepnet’s Smishing Simulator allows organizations to replicate region-specific threats, such as fake tax refund alerts from HMRC in the UK or phishing scams targeting financial services in the US. These customized SMS phishing simulations enhance employee preparedness for real-world scenarios.

Read our step-by-step guide to learn how to create an SMS phishing simulation campaign.

Also, watch the video below to get more details about how to launch SMS phishing campaigns.

With the rise of smishing attacks targeting trusted brands, businesses need more than awareness. They need actionable tools and measurable results. Keepnet’s secure behaviour management platform combines cutting-edge phishing simulations, advanced reporting, and AI-powered training to empower organizations against evolving threats.