The scam call has a quieter, equally dangerous cousin: the scam text. Known as smishing — a blend of SMS and phishing — these fraudulent messages land in your inbox looking routine and urgent, hoping you'll tap a link or reply before thinking. As people grow wary of suspicious calls, criminals have poured energy into text scams. This guide shows you how to recognize smishing and stop it cold.
What smishing is
Smishing is a phishing attack delivered by text message. The goal is the same as any phishing: trick you into revealing sensitive information, handing over money, or installing malware. Texts feel personal and immediate, and many people trust them more than email — which is precisely why scammers love the channel.
The most common smishing scams
A handful of templates account for the majority of scam texts:
- Fake delivery notices: a message claims a package is held or a delivery failed, with a link to 'reschedule' that steals your details.
- Bank alerts: a text warns of suspicious activity and urges you to click a link or call a number to 'secure' your account.
- Account verification: a message asks you to confirm login details for a popular service, leading to a fake login page.
- Prize and refund bait: you've won something or are owed a refund — just provide your information or pay a small fee.
- Wrong-number openers: a friendly 'oops, wrong number' message that evolves into a long con, often an investment or romance scam.
How to recognize a smishing text
Scam texts share telltale traits. Watch for a sense of urgency or threat, requests to click a shortened or odd-looking link, generic greetings that don't use your name, sender numbers that don't match the supposed organization, and any demand for passwords, codes or payment. Legitimate companies rarely ask you to resolve urgent account problems through a text link.
A real bank won't fix an emergency through a link in a text. If a message rushes you toward a link, that pressure is the scam.
What to do when you receive one
Your response matters as much as your recognition:
- Don't tap links or call numbers contained in a suspicious text.
- Don't reply, even to say 'stop' — a reply confirms your number is active.
- Verify independently by contacting the organization through its official app or website.
- Look up the sender's number to check whether others have reported it.
- Report and delete the message using your phone's spam-reporting feature.
Why the links are so dangerous
The link is the heart of most smishing attacks. Tapping it may lead to a convincing fake login page that harvests your credentials, a form that collects personal and payment details, or in some cases a prompt to install a malicious app. Even just loading the page can reveal information about your device. The safest habit is absolute: never tap links in unsolicited texts, no matter how legitimate they appear.
Protecting yourself long-term
Beyond handling individual messages, a few habits reduce smishing over time. Guard your phone number and avoid posting it publicly or entering it into untrusted forms. Enable any spam-text filtering your phone or carrier offers. Keep your device and apps updated so known vulnerabilities are patched. And talk with less tech-savvy family members, who are frequent targets, about never tapping links in unexpected texts.
If you've already tapped
If you clicked a smishing link or entered information, act quickly. Change the password for any account you may have exposed, and enable strong two-factor authentication. Contact your bank if you shared financial details, and watch your accounts for unauthorized activity. Run a security check on your device if you were prompted to install anything. Fast action sharply limits the harm.
The anatomy of a smishing text
Smishing — scam texts — follow recognizable patterns once you know what to look for. They typically create urgency ('your package is held,' 'unusual account activity,' 'verify immediately'), include a link to a fake but convincing website, and often spoof a sender name you trust. The link is the payload: it leads to a page designed to harvest your login details, payment information or personal data, or to install malicious software.
The defining rule for smishing mirrors the rule for scam calls: never act through a link or number provided in an unexpected message. If a text claims your bank, a delivery company or a government service needs your attention, open their official app or type their known website address yourself. The legitimate version of any such message can always be confirmed through the front door; only scams require you to use their link.
Why texts are such effective bait
Texts feel more personal and urgent than email, are read almost immediately, and offer fewer obvious cues to judge legitimacy — there's no sender address to scrutinize, just a name and a link. Scammers exploit this intimacy and immediacy. A message that would look suspicious as an email can feel plausible as a text precisely because we're used to texts being short, direct and from people we know.
What to do with a suspicious text
Don't tap the link, don't reply (even 'STOP' confirms your number is active to a scammer), and don't forward it to friends in a way that spreads the link. Instead, delete it, and where your carrier supports it, report the message so it feeds spam filtering. If the text references a real account you hold, check that account directly through its official app, and change your password if anything looks wrong. A reverse lookup on the sending number can also reveal a VOIP line and spam reports that confirm your suspicion.
Building a reflex against scam texts
Defending against smishing comes down to one reflex applied consistently: never act through a link or number contained in an unexpected text. If a message claims your bank, a delivery service or a government agency needs your attention, reach them through their official app or a web address you type yourself. The legitimate version of any genuine alert is always reachable through the front door, so the requirement to use the text's link is itself the tell that it's a scam.
Reinforce the reflex with a few supporting habits: don't reply to suspicious texts (even a single word confirms your number is active), don't tap links to 'unsubscribe,' delete and report the message where your carrier allows, and check any referenced account directly through its official app. A quick reverse lookup on the sending number can confirm a VOIP line and spam reports. None of this requires expertise — just the steady discipline of refusing to follow a stranger's link.
Key takeaway
Smishing is phishing by text, using urgency and malicious links to steal your data or money. Recognize it by pressure, odd links, generic greetings and mismatched senders. Never tap links or reply; verify through official channels, look up and report the sender, and delete the message. If you've tapped, change passwords and monitor your accounts immediately.