ScamAI University
Lab 106 — The Smishing Forge
Phishing the Crowd · 106
Lab 106 Active
The Smishing Forge
You have 500,000 US phone numbers, a bulk SMS API, and a jailbroken LLM. Build the most convincing smishing text you can — then switch seats and spot every red flag in what you just sent.
Step 1
Choose Your Lure
DMV · Package · Job
Step 2
Amplify the Attack
4 manipulation levers
Step 3
Defender Debrief
Find all 6 red flags
Educational simulation.
This lab shows how smishing texts are crafted and what makes them convincing — so you can recognize and resist them in the wild. No real messages are sent.
SmishForge Pro v2.4 — Campaign Builder
500,000 numbers loaded · API: connected
1
Choose Your Lure
DMV License Threat
FTC: $19M lost to DMV impersonation in 2023
USPS Package Fee
USPS OIG: 26M fraudulent delivery texts per day in 2023
Fake Job Offer
FTC: $367M in job scam losses in 2023 (+76% YoY)
2
Amplify the Attack
AI-Perfect Wording
WormGPT writes government-register prose. MIT study: +54% click-through vs generic copy.
+25%
Spoof Sender ID
Text appears from "USPS", "DMV-Notice", or "Google-Recruit" instead of a random number. Costs $15.
+30%
Name Personalization
Mail-merge inserts victim's first name from the breach list. Open rate increases 34% when name appears.
+20%
Short URL (bit.ly)
Hides the phishing domain until after the click. Removes the one moment victims might hesitate.
+15%
Live Preview
9:41
Today 9:41 AM
Select a lure to preview your message...
Hi Sandra, NOTICE: Your CA DMV account shows an unpaid toll balance of $39.47. Your driving privileges are at risk of suspension within 72 hours. Immediate payment required. Your DMV account shows an outstanding balance of $39.47. Failure to pay within 72 hours may result in license suspension. bit.ly/4xKm2r9dmv-renewal-portal.gov.com/pay
Hi Sandra, USPS Notification: Package #9400111899222 requires address verification before final delivery. A $3.99 redelivery fee must be paid within 24 hours to avoid return to sender. USPS: Your package #9400111899222 requires address confirmation. $3.99 redelivery fee required before delivery. bit.ly/usps-fee9usps-redelivery-portal.com/confirm
Hi Sandra, Congratulations! Your application for a Senior Remote Associate role at Google ($78K–$95K, full benefits) has been approved. Please schedule your onboarding interview before this offer expires. Your job application at Google has been approved. Click to schedule your interview before this offer expires. $78K–$95K base salary. bit.ly/google-hiregoogle-careers-portal.net/schedule
Threat Score
SmishForge Pro · Deploying Campaign
$ smish-blast --targets 500000 --api bulk-sms-pro
› Loading target list... ✓ 500,000 US mobile numbers
› Sender ID:
› Personalization:
› Routing through 14 carrier gateways...
› Sent:
› Blast complete. 500,000 texts delivered. ✓
█
Campaign Analytics
500,000 Texts Deployed
Here's how your configuration performed.
500K
Texts Sent
$240 total cost
Clicked Link
Submitted Data
Est. Revenue
Message Sent
FROM
TO
500,000 US mobile numbers
BODY
Attack Vector Contribution
AI Wording
+25% CTR
Spoofed Sender
+30% CTR
Personalization
+20% CTR
Short URL
+15% CTR
No amplifiers active — baseline attack only.
Defender Mode
Find the Red Flags
The same message your victims received — now from the defender's seat. Click every underlined element to reveal the manipulation tactic.
/ 6 red flags found
9:41
Today 9:41 AM
Hi Sandra,
NOTICE: Your CA DMV account shows an unpaid toll balance of
$39.47.
Your driving privileges are at risk of suspension
within 72 hours.
Immediate payment required.
dmv-renewal-portal.gov.com/bit.ly/4xKm2r9
Hi Sandra,
USPS Notification: Package
#9400111899222
requires address verification before final delivery.
A $3.99 redelivery fee
must be paid
within 24 hours to avoid return to sender.
usps-redelivery-portal.com/confirm
Hi Sandra,
Congratulations! Your application for a Senior Remote Associate role at Google
($78K–$95K, full benefits)
has been approved. Please schedule your onboarding interview
before this offer expires.
google-careers-portal.net/schedule
All 6 Red Flags Found
Three Rules That Stop Smishing Cold
1
Never click a link from an unexpected text. Navigate directly.
Open a new browser tab and type usps.com, dmv.ca.gov, or the company's careers page yourself. The real site will tell you within 15 seconds if the text was fraudulent.
2
Government agencies use mail, not SMS payment requests.
The USPS, DMV, and IRS do not send fee payment requests via text. Any SMS threatening a consequence that requires immediate payment is a scam — no exceptions.
3
Report it: forward to 7726 (SPAM) + file at ReportFraud.ftc.gov.
Forwarding to 7726 alerts your carrier's fraud team. FTC reports cluster with others to trigger domain takedowns — often within 72 hours of enough complaints. Your report matters.
$19M
DMV impersonation losses in 2023 (FTC)
26M
Fraudulent USPS texts per day at 2023 peak
$367M
Job scam losses 2023 — +76% year-over-year (FTC)
