User Tools

Site Tools


LUCY MANUAL Applies to LUCY versions above 2.2.


This is an old revision of the document!

Background Info

Smishing (short for SMS Phishing) is a variant of phishing email scams that uses Short Message Service (SMS) systems to send out bogus text messages. Also written as SMiShing, SMS phishing made recent headlines when a vulnerability in the IPhone's SMS text messaging system was discovered that made smishing on the mobile device possible.

Smishing scams frequently seek to direct the text message recipient to visit a website or call a phone number. At which point, the person being scammed is enticed to provide sensitive information such as credit card details or passwords. Smishing websites are also known to attempt to infect the person's phone with Malware.

How is LUCY sending SMS?

LUCY has a build in API which will connect to a centralized LUCY gateway when initializing SMS delivery. The gateway will first verify, if the LUCY client has sufficient credits and is allowed to send SMS. If all checks pass our gateway will connect to an international provider using a second API. This provider is able to send the messages with the settings defined in LUCY.


In order to use the smishing feature in LUCY, you need a:

a) commercial license and

b) sufficient balance


  • Where can I see my current assets available for this feature?

You can find your current credit under settings/licence:

  • How do I add credits?

In LUCY you have a button next to the balance which enables you to buy more credits directly within the LUCY GUI.

  • How many credits do I need?

One sms usally costs between 3 and 9 cents. Here's the detailed pricing page (there is a selection for destination country):

  • How do I get a commercial licence?

After deciding which pricing model you need you can purchase and activate lucy in order for this feature to work.


Within the scenario (Base Settings –> Scenario Settings –> Message Settings) you can use as a delivery method either "mail" or "sms". Choose "SMS". As a sender you can put a name or phone number (use always the phone number with the country code: example 49 xxx). The actual phone number should have no "00" and "+" in front, i.e. 41796959611 (41 - Switzerland country code) and not 0041796959611 or +41796959611. See

If the phone number is saved in the recipient's contacts, it will show the corresponding contact information upon arrival of the SMS.

Next, you will need to enter the phone number in your recipient's list. Don't forget to also set the correct language (the language should match the language chosen in General Settings (Base Settings –> Scenario settings –> Base Settings).

Automated URL Shortening

When you place the %link% variable within the message body and your scenario uses a public domain name, it will automatically be shortened. The link will look like "” to fit into one text message. If you use an IP address for your landing page the link will be not shortened.

Known Issues

  • Issues when spoofing within same provider: Spoofing a message within same provider within the same country might not work. For example: if you want to send a spoofed message from a cell phone using “o2” to another cell phone using “o2” the message won't arrive. But if you send the same message from a phone using “telekom” to a cell phone using “o2” it will work
  • Issues with specific countries: in certain countries SMS spoofing will not work at all or SMS might only arrive if the sender is using a different country code. Example: in Belgium the SMS sender will get replaced by a general number like "8850" when using a different country code.
smishing.1555941247.txt.gz · Last modified: 2019/07/25 12:50 (external edit)