Smishing Campaigns: How to Take Down the Fake Landing Pages
Your brand's name just appeared in a text message your customer never asked for. The link led to a convincing replica of your website. They entered their card details. Now they are calling your customer service team, angry and confused, and the damage is yours to manage.
This is smishing: SMS phishing that uses your brand's identity as bait. And the part most companies focus on last, the fake landing page the link points to, is actually the most important thing to kill first.
The message is the hook. The fake website is where the fraud happens. Removing the landing page is what stops the scam in its tracks.
Smishing volumes are rising sharply. According to the APWG's Q4 2025 Phishing Activity Trends Report, SMS-based fraud detections showed steady 30 to 40 per cent growth quarter-over-quarter throughout 2025. The UK is a particularly active target: National Trading Standards data shows UK adults receive around seven scam calls or texts per month on average, with one in five targeted most days.
For brands, the reputational and financial exposure is significant. The question is what you can actually do about it.
The Most Common Brand Smishing Scams
Smishing campaigns tend to cluster around a handful of high-trust brand categories, because the more familiar the sender appears, the more likely the recipient is to click.
Delivery and parcel scams
This is consistently the most impersonated category in the UK. Criminals send texts claiming a parcel is held, a customs fee is due, or a delivery attempt was missed. The link leads to a pixel-perfect clone of a courier's website, complete with logos, fonts, and form fields designed to capture card details or home addresses.
Royal Mail and Evri are among the most frequently impersonated brands in Citizens Advice reports, but any recognisable delivery brand is a viable target.
Account alert and banking scams
These are arguably more dangerous because they exploit existing trust threads. A fraudulent text warning of "unusual activity" can appear directly beneath a legitimate message from the same bank in a recipient's SMS thread, because criminals spoof sender names.
The link resolves to a fake login page. The victim enters credentials. The attacker captures them in real time.
Subscription and account verification scams
Streaming services, utilities, and subscription brands are targeted with texts claiming a payment has failed or an account needs verification. The urgency is manufactured, the landing page is convincing, and the data harvested is used immediately or sold.
What all of these have in common: a short link, often a redirected URL, that routes the victim to a fake page hosted on a domain that has nothing to do with your brand. That domain is the enforcement target.
Tracing Short Links Back to the Source
Smishing texts rarely link directly to the fake landing page. Attackers use URL shorteners, redirect chains, and fast-flux hosting to obscure the destination and make simple blocklists age quickly. Researchers tracking the "Smishing Triad," a large-scale industrialised operation, found approximately 194,000 malicious domains in use since the start of 2024, with thousands of new domains cycling in weekly, many of which survive only a few days before being replaced.
This is the core challenge for brands trying to self-manage enforcement: by the time you find the page, it may already be down and replaced by an identical one on a new domain.
Effective tracing requires:
- Expanding the short link to reveal the actual destination URL
- Identifying the registrar, hosting provider, and name servers behind that domain
- Checking whether the domain is using brand-lookalike naming conventions, such as hyphens, misspellings, or appended keywords
- Documenting the page content, including screenshots and source code, before it disappears
- Identifying whether the same infrastructure is being used across multiple fake pages targeting your brand
This is not a one-time task. Smishing campaigns run continuously, and the infrastructure behind them is designed to evade and replace quickly. Monitoring has to be ongoing, not reactive.
Taking Down the Fake Landing Pages
Once a fake landing page is identified, the enforcement process involves multiple parallel channels. Waiting for one to work is not a viable strategy when the page may only be live for 48 hours.
What fast takedown actually involves
Effective removal targets the page at the source, not just its visibility. The key actions are:
- Sending legal notices directly to the hosting provider and domain registrar
- Filing with search engines to de-index the page from results, so customers who search for it cannot find it
- Escalating to payment processors and advertising networks if the fake site is running paid traffic
- Monitoring for re-uploads on new domains after the original is taken down
Speed is the critical variable. The longer a fake page stays live, the more data it collects and the more customers are exposed to it. According to Remove.tech's brand protection data, automated systems can boost takedown rates by up to three to five times compared to manual processes, precisely because they file the moment an infringement is detected rather than waiting for a human review cycle.
Why manual enforcement falls short
Most brand teams discover smishing campaigns through customer complaints, by which point the page has already been live for hours or days. Self-filing takedowns with hosting providers is slow, often requires account registration, and provides no guarantee of response time. And if the same campaign is running across ten domains simultaneously, manual management becomes unworkable.
Remove.tech's brand protection platform handles fake website and domain removal as a core service, with 24/7 scanning across search engines, domain registrars, and the open web. The platform automatically sends legal notices to unauthorised publishers and de-indexes content from search engines, with real-time documentation of every action taken.
What to Tell Your Customers
Taking down the page is the enforcement side. But your customers also need to know what to watch for, because the same campaign will likely target them again.
A short, clear advisory on your website or in your customer communications should cover:
- Your brand will never ask customers to verify payment details, log in, or confirm personal information via a link in a text message
- Any text claiming to be from your brand should be verified by going directly to your official website or app, not by clicking the link in the message
- Shortened URLs and unfamiliar domain names in otherwise official-looking messages are a reliable warning sign
- Suspicious texts can be reported in the UK by forwarding them to 7726, a free service available on all major networks
Note for UK customers: Between April 2020 and April 2025, reports made via 7726 led to the removal of over 27,000 scam websites, according to published data from the service. Encouraging your customers to report is a direct contribution to wider enforcement.
Proactive communication also protects your brand. When customers understand what a legitimate message from you looks like, they are less likely to be deceived, and less likely to hold your brand responsible when they are.
If your brand is currently being used in an active smishing campaign, it is worth considering a free brand audit to understand the full scope of what is out there before committing to a removal strategy.
FAQ
What is smishing and how does it affect my brand?
Smishing is SMS phishing. Criminals send text messages impersonating your brand to trick recipients into clicking a link that leads to a fake website. The harm to your brand comes from customer data loss, eroded trust, and the association of your name with fraud.
Can fake landing pages used in smishing campaigns actually be removed?
Yes. Fake websites and domains can be taken down by filing legal notices with hosting providers and domain registrars, and by requesting de-indexing from search engines. The process is faster and more effective when automated, as manual filing is slow relative to how quickly these pages are replaced.
How does Remove.tech handle smishing-related fake websites?
Remove.tech's brand protection platform includes fake website and domain removal as a core service. The platform scans continuously, files takedown notices automatically, and monitors for re-uploads after enforcement, with real-time reporting via a dedicated dashboard.
What should I do if my brand is being impersonated in a smishing campaign right now?
Document any examples you have, notify your legal team, and start the takedown process quickly. A free brand audit from Remove.tech can help identify active pages using your brand before you commit to a removal strategy.
