Text Message Scams (Smishing) and How to Spot Them
Scam texts have overtaken many phone scams because they are cheap, automated, and easy to ignore until one catches you at the wrong moment. Here is how to read them.
Smishing — scam delivered by SMS — has exploded because texting is cheap to automate and people read messages faster and more trustingly than they answer calls. A well-timed fake text about a delivery or a bank alert can slip past your guard in a distracted moment. Learning the patterns inoculates you against nearly all of them.
Why texts are such effective bait
A text feels personal and urgent. It sits in the same inbox as messages from people you trust, it is short enough to read before thinking, and it almost always contains a tappable link that makes acting frictionless. Scammers exploit all three traits at once, pairing a believable pretext with a single easy tap that leads somewhere harmful.
The most common templates
- Delivery notices claiming a parcel is held pending a fee or address confirmation.
- Bank or payment alerts warning of suspicious activity with a link to verify.
- Account-locked messages for streaming, email, or shopping services.
- Prize or refund notifications promising money in exchange for details.
- Fake messages from a boss or family member asking for urgent help or gift cards.
The two dangerous payloads
Almost every scam text wants you to do one of two things: tap a link or call a number. The link leads to a fake login page that harvests your credentials or to a site that tries to install malware. The callback number connects you to a live scammer running a verbal version of the con. Recognizing that the link and the number are the trap — not the message text — makes the right response obvious: do not tap, do not call.
How to verify safely
If a text might be real — a delivery you are expecting, a genuine bank concern — verify through a channel you control. Open the carrier's or bank's official app, or type the known website address yourself. Never use the link or number in the message. The legitimate version of any service is always reachable independently, so the message's own links are never necessary.
What to do with a suspicious text
- Do not tap links or call numbers in the message.
- Do not reply, even to say stop, which confirms your number is active.
- Verify any real-sounding claim through the official app or website you open yourself.
- Report the message as junk or spam, and forward smishing to your country's reporting shortcode where available.
- Delete it once reported.
If you already tapped
Mistakes happen. If you entered details on a fake page, change that password immediately and anywhere you reused it, enable an authenticator app, and watch your accounts. If you installed something, run a security scan and consider a factory reset for a deep infection. Acting fast shrinks the damage, and reporting it helps protect the next person who gets the same text.