Early last year, Grant Smith received an alarmed message from his wife. She had gotten a text notification about a delayed package, clicked the link, and paid a fee. Then she realized that it was not, in fact, the United States Postal Service asking for her credit-card information—that she had no idea who had just collected her payment info. She quickly canceled the card.

The Smiths had been smished. Short for “SMS phishing”—cyberattacks that arrive via text message—smishing refers to a particular type of spam message that you’ve probably received once or twice, if not dozens of times. They impersonate brands or federal agencies, such as Citigroup or USPS, in the hopes of getting people to hand over their personal information.

Smith, it so happens, is a sort of hacker himself—he works in

See Full Page