What smishing means
Smishing is a blend of “SMS” and “phishing.” It describes fraudulent text messages designed to make you click a link, call a number, reply with personal details or send money. The same idea shows up in other messaging apps, so the habits here apply broadly.
Texts are effective for scammers because they feel personal and immediate. People tend to read them within minutes, and the small screen hides details that would stand out on a computer, like the full web address.
How these messages try to work
A text has very little room to persuade you, so it usually relies on a few levers.
- Urgency. “Your account will be suspended today.” “Action required.”
- Curiosity. “Is this you in this photo?” or “You have a new voicemail.”
- Fear. A claimed unpaid fine, a security alert or a suspicious login.
- Reward. A refund, a prize or a free gift.
- Familiarity. “Hi, it’s me, I lost my phone, this is my new number.”
- The wrong-number opener. A casual “Hi, are we still on for dinner?” meant to start a conversation that later turns to money or an investment.
The goal is to get you to act before thinking. The message does not need to be believable to everyone, just to the small share of people it reaches at the right moment.
Common stories
Specific stories vary by region and season, but several recur:
- A parcel could not be delivered and a fee or new address is needed. This overlaps with package delivery scams.
- A bank or payment service reports a problem with your account.
- A toll, fine or government payment is overdue.
- A job offer arrives out of nowhere, promising easy pay.
- A code is “accidentally” sent to you and the sender asks you to send it back.
- A relative or friend is supposedly in trouble from a new number.
- A message about a login attempt tells you to follow a link to secure your account.
If you have not done something that would cause the message, it is probably not real. Even if it matches something you have done, as with a real delivery, check separately before using the message’s link.
Clues that a text may not be genuine
None of these is proof on its own, but several together tell a story.
- It comes from an unknown or oddly formatted number, or an email address.
- It addresses you generically.
- It contains a shortened link or an address that looks like but is not quite the real one, as covered in guidance on lookalike web addresses.
- It has awkward wording or unusual punctuation.
- It pushes you to act right away.
- It asks for payment in an unusual way, such as gift cards or cryptocurrency.
- It asks for a verification code. Codes sent to your phone should only be entered by you, on the site or app you chose to open.
Also remember that scam texts can appear in the same thread as a legitimate message from a real company, because senders can imitate the name or number. Seeing a text in an existing conversation is not a guarantee.
What to do when one arrives
- Do not tap links or call numbers in the message. This includes “STOP” replies, which may confirm that your number is active.
- Do not reply. Even a short answer tells the sender someone is reading.
- Check independently. If the message mentions your bank, a delivery or an account, open the official app or type the website address yourself, or call the number on your card.
- Report it. Many phones let you report junk messages through the messaging app, and many carriers accept forwarded spam to a reporting number. Check your carrier’s information for the correct method. You can also report to your national fraud reporting service.
- Block the sender. This may not stop new numbers, but it reduces repeats.
- Delete the message. Once reported, there is no need to keep it.
If you clicked or replied
You are not alone, and the situation can usually be handled calmly.
- If you only tapped a link and nothing else happened, close the page and do not enter anything. Consider a security scan, and keep your phone software updates current.
- If you entered a password, change it immediately on the real site and anywhere you reused it. Password reuse makes one slip spread to other accounts.
- If you shared a code or banking details, contact your bank or provider right away through an official channel.
- If you installed an app because of the text, remove it and review app permissions; a fake mobile app can read or send messages.
- If you sent money, report it to your bank and to your local police or fraud reporting service. Recovery is not guaranteed, but speed often helps.
- Keep an eye on statements and consider setting up transaction alerts so you see unusual activity quickly.
Making your phone harder to target
- Turn on your phone’s built-in spam filtering for unknown senders if offered.
- Keep your phone and apps updated.
- Be selective about where you share your number.
- Use two-step sign-in with an app or key where possible, since a text code is better than nothing but is not the strongest option.
- Talk to family, especially older relatives, about how these messages work.
A simple habit
The best single rule is: never act on a text by using what is in the text. Open the official app or website yourself, or call a number you already trust. It adds a few seconds and removes most of the scammer’s advantage.
If a message includes threats against you or someone else, contact your local police, and call emergency services if anyone is in immediate danger.