Short answer
Phishing text messages are reaching design firms because attackers have shifted from email to texts, calls and QR codes. Email filters have improved, while a text sent to a phone skips the filters a firm pays for. Verizon’s 2026 report is reported to describe mobile attacks as more successful than email phishing. Three rules help: do not log in from a text link, verify “new number” texts by calling the old number, and report instead of replying. Coverage for incidents that start on personal phones varies by policy, so review the actual wording.
Why phishing text messages are growing
Many firms have invested in email filtering, and it catches a lot. A text message or phone call does not pass through any of it. The message goes straight to the person.
Secondary coverage of Verizon’s 2026 breach report describes text and voice social engineering as more successful than email phishing. Please check that wording against the original Verizon report before relying on it. The data spans many industries, so it does not predict what will happen at any one firm.
Why phones are riskier than computers
Phones make it harder to spot a bad message. A small screen often hides most of a web address, so a slightly altered link is easy to miss. Personal phones also tend to lack the security tools a firm may run on its computers.
People also respond faster on a phone. A text feels personal and urgent, especially when someone is on a job site and moving between tasks.
Common phone lures for design firms
Architects and engineers see a few patterns more often than others:
- Permit or plan-review notices. A text says action is needed on a submission and includes a link.
- Fake MFA prompts. A message or call asks you to approve a login or read out a code you did not request.
- QR codes. A code on a flyer, an email or a job-site sign leads to a fake sign-in page.
- “It’s me, new number” texts. A message appears to come from a principal and asks for a quick favor or a payment.
The phishing and IT security checklist covers the QR code and phone call scenario in more detail.
Three rules for phishing text messages
The FBI’s public service announcement on smishing and vishing advises people to verify requests by calling a known number and to check web addresses for small changes. That announcement concerned impersonation of officials, but the habits apply to firms as well. Three simple rules put them into practice:
- Do not log in from a text link. Open the website or app yourself instead.
- Verify “new number” texts by calling the old number. Use a number you already have, not one in the message.
- Report and do not reply. Tell the person in charge of IT or security, then delete the message.
Never share a verification code with anyone who contacts you, even if they sound official.
Voice and video can be faked too
Phone scams do not stop at text. A caller can imitate a familiar voice, and fake video has fooled a finance employee at a global engineering firm. The deepfake video call case is the extreme example. The call-back rule works for voice and video the same way it works for text.
Real-world example
Consider a hypothetical six-person engineering firm. A project engineer is on a job site when a text arrives from an unknown number. It says it is the principal’s new phone and asks him to buy gift cards for a client and send the codes.
The request is odd, and it came from an unfamiliar number. He does not reply. He calls the principal’s saved number, and the principal confirms it was not him. He reports the text to the office manager, who reminds staff about the rule.
The call took less than a minute.
What to check in your firm
Firms may want to review:
- Whether staff know not to log in from links in text messages.
- Whether a “new number” text from a principal is always verified by calling the old number.
- Whether staff use personal phones for work email or file access, and what security those phones have.
- Whether multifactor authentication (MFA) is turned on for the accounts reachable from phones.
- Whether staff know who to tell about a suspicious text or QR code.
Do cyber policies cover incidents that start on personal phones?
It depends on the policy. Some wording may cover incidents based on what was affected, such as a firm email account, while other wording may address personal devices differently. A policy may also ask what security applies to devices used for work.
Do not assume the answer either way. Ask your broker how the policy treats personal devices, and read the cyber application questions about them if any apply. Payment losses that start with a text typically raise social engineering coverage questions, and the comparing cyber quotes page shows where to find that line.
Hardcover insight
Firms often protect the office computer and forget the phone in the principal’s pocket. Many field staff handle email, approvals and payments from phones all day. A short reminder of three rules costs nothing, and it addresses a channel that most filters do not cover.
Related questions
What are phishing text messages?
They are scam texts that try to get you to click a link, share a code or send money. They often pose as a government office, a delivery service or someone you know.
What is the difference between smishing and vishing?
Smishing uses text messages, and vishing uses phone calls. Both aim to trick you into sharing information or sending money.
What should I do with a suspicious “new number” text?
Do not reply. Call the person on the number you already have, then report the message to whoever handles security at your firm.
Are QR codes safe to scan?
Not always. A QR code can lead to a fake sign-in page, and the small screen can hide the address. Open the website yourself if the code involves a login or payment.
Does cyber insurance cover an attack that starts on a personal phone?
It depends on the policy wording and what was affected. Review the policy or ask a broker how it treats personal devices.