Smishing: What a Scam Text Message Is and How to Spot One

What smishing means

The name joins SMS with phishing, the word used for fake messages that try to fish the information out of whoever receives them. Only the channel changes, and the care you take is the same as with any other fake message that goes after your information. The Federal Communications Commission uses the same term in its consumer guidance on smishing, and its advice is short: do not click links or call numbers in a text you were not expecting.

Because a text has so little room, the scam is usually brief: a warning, a deadline, and a link. The missing detail that would look strange in an email looks normal in a text message, and that is part of why the format works so well.

Text is also where a lot of the volume sits. The FTC keeps a page on spam text messages for exactly this reason, and the United States Postal Inspection Service has its own alert about package tracking text scams, because delivery is the single most reused story.

The stories used most in a text message

The subjects repeat because they fit almost everyone at once. A package held at customs, a delivery fee owed, an unpaid toll, a suspicious charge on a card, points or rewards expiring, a bank app that needs reinstalling, a benefit that needs reconfirming. The message does not need to know which package is yours. It only needs you to have one coming.

Small amounts lower resistance too. The page may ask for a card and a few personal details in order to collect a dollar or two, while the real goal is the information that gets used later. A small amount, a short deadline, and an everyday subject are standard tools of social engineering, the use of conversation and pressure to get someone to act before they check.

Why the text can look real

Some phones group messages by name or by short code, so a fake text can land in the same thread as the real ones from a company. Being in that thread does not authenticate anything: it only means the sender ID matched. With banks this is common, which is why we cover fake bank text messages on their own.

The number on screen is no better as proof. The information a sender presents can be falsified, which is why a short code, a display name, or a local area code is not evidence of anything. Clean writing and the use of your first name are not evidence either, since both are cheap to produce.

What is worth reading instead is the shape of the request. Look at whether the text creates a short deadline and offers exactly one way to resolve it, and whether that one way runs through a link in the message rather than through an account you already have.

Why filters and blocking do not catch everything

Carriers and phone makers do filter some of this, and it is worth turning those tools on. On an iPhone, the Messages settings include an option to filter messages from unknown senders into a separate list. On Android, Google Messages lets you block a sender and report the message as spam, described in the Google Messages help on blocking senders and reporting spam. Both put a dent in the volume.

Neither is a wall. Scam texts move between numbers constantly, so blocking one sender stops that number and nothing else, and messages sent through internet messaging or email-to-text routes can arrive looking like something your filter has no history with. The FCC makes the same point in its guidance on unwanted robocalls and texts, where filtering is one layer among several rather than the answer.

So treat the filter as something that reduces how often you have to decide, not as something that decides for you. The text that gets through is not more legitimate for having gotten through, and the check that matters still happens outside the message.

Check deliveries and charges outside the text

For a delivery, open the app or type the site of the store where you bought the item, or of the carrier, and look at the order that is already on record. For a bank or a card, open the official app and read the transactions and alerts there. Do not copy a tracking number, a phone number, or an address out of the suspicious text to start that search, because a tracking number invented for the scam will only lead back to the scam.

Scammers use carrier names in these texts, and the carriers are not the ones sending them. The Postal Inspection Service says plainly that the Postal Service does not send text messages about a package unless a customer signed up for tracking updates, and the FCC covers the same pattern in its guidance on package delivery scams. A real pending item can always be found without the link.

If nothing shows up in the official account, do not pay just to release or regularize something. There is no version of a real charge that can only be settled through a link in a text.

Do not reply, block, and report

Do not reply, not even to say you spotted it or to ask them to stop, and do not call the number in the text, because that number is part of the scam. A reply confirms the line is live and usually brings more of them.

Then forward the message to 7726, which spells SPAM on the keypad and reports the sending number to your wireless carrier. The FCC points to this in its guidance on unwanted robocalls and texts. Block the sender in your messaging app afterward, and report the text to the FTC at ReportFraud.ftc.gov.

If a text tells you to install an app, whether to secure your account, release a delivery, or update a banking token, do not install it. Install apps only from the official app store, and never from a link that arrived in a message. A program installed that way can hand the sender access to your phone, and from there to everything you sign into on it.

If you already tapped the link

Close the page. If you did not type anything, you are almost certainly fine, and there is no reason to go back and test it. What matters is whether you entered something or paid.

1. If you entered card details, call the number on the back of the card now. Report the charge as fraud, ask whether it can be stopped, and ask for a new card number. The FTC explains the difference in protection between credit and debit cards, and a debit card gives you less room, so the call is more urgent.
2. If you sent money another way, call your bank immediately, report it as fraud and ask what recovery options exist on that payment type. The Consumer Financial Protection Bureau covers money transfers and what a bank can and cannot do after the fact.
3. If you typed a password, change it on the official site, and change it anywhere you reused it. Turn on two-factor authentication so the password alone is not enough.
4. Keep the evidence before you delete anything. Screenshot the text, note the address the link opened and the time it arrived, and keep any receipt. Reports are more useful with that attached, and a bank dispute usually asks for it.
5. Report it. File at ReportFraud.ftc.gov and, if money moved, at the FBI’s Internet Crime Complaint Center. If personal information was exposed, IdentityTheft.gov will build a recovery plan.

If the text was followed by a phone call from someone claiming to be the bank’s fraud department, read how phone call scams work before you call anyone back. The two halves are often run by the same people.

Smishing FAQ