In short: smishing is phishing by text message or chat app — a short message with a link that gets you to pay a small sum or enter your card details on a fake page.
Simply put: The messages often come from a "courier" ("your parcel is waiting, pay €1.99"), a "bank" or an "authority". The small sum is the bait — the real target is your card details and the confirmation code, which are then used for much larger payments.
Example: A text: "Your parcel is on hold. Pay a €1.99 fee here." You are not expecting a parcel. You don't click; you check on the courier's website, which you open yourself.
Watch out: the sender of a text can appear under the name of a real company — the name alone proves nothing.
What to do: don't open links in unexpected texts. If you entered card details — block the card at once and call your bank. A code you didn't ask for is never entered anywhere.
Source: ENISA — Threat Landscape: Finance Sector (2025): https://www.enisa.europa.eu/sites/default/files/2025-02/Finance%20TL%202024_Final.pdf · Europol — Online fraud schemes: https://www.europol.europa.eu/crime-areas/online-fraud-schemes