Text Message Scams and Smishing

What smishing is

Smishing is phishing carried out by text message (SMS), and sometimes by other phone messaging apps. The sender impersonates a bank, delivery company, government body or someone you know, with the aim of getting you to click a link, call a number, reply with information or send money.

The structure is the same as in phishing emails, but compressed into a few lines.

Why texts work so well on phones

Several features of phones make scam texts more effective than the same message in an inbox.

• High attention. People tend to read texts quickly, and many are opened within minutes. A message that looks like a short alert gets a fast reaction.
• Little room to inspect. A small screen shows a short preview and often truncates links, so there is less chance to examine details.
• Trust in the channel. Texts are associated with friends, family and real alerts such as delivery slots, appointment reminders and bank codes, so a scam sits among genuine messages.
• Easy action. One tap on a link opens a web page; the next step is a form in the same hand.
• Fewer filters. Email has long had mature spam filters, while text filtering varies by carrier and country and may be less thorough.
• Cheap volume. Messages can be sent to huge ranges of numbers at very low cost, so even a tiny response rate can pay.

Another point is that sender details can be unreliable. As with calls, the sender name or number can sometimes be faked, and a spoofed message may appear in the same conversation thread as genuine messages from a real company. The same principle that applies to caller ID spoofing therefore applies to texts. Newer standards such as RCS messaging add some sender-verification features, but you cannot assume a message is safe because of the app that delivered it.

Patterns that repeat

• Missed delivery. A text says a parcel could not be delivered, and asks for a small fee or address update through a link. See marketplace and delivery scams for the wider picture.
• Bank or card alerts. “Suspicious payment” or “account locked” messages with a link or a number to call.
• Unpaid toll, fine or tax. A small amount owed, with a short deadline and a payment link.
• Wrong number. A friendly or apologetic text seemingly sent to the wrong person, hoping you will reply. The conversation may later drift into romance scams or investment talk.
• Prize, refund or reward. Money or a gift waits if you click.
• Family emergency. “Hi Mum, my phone broke, this is my new number”, followed by an urgent request for money.
• Account verification. A code arrives, and a follow-up message from a “friend” or “support” asks you to read it back.
• Job offers. Unsolicited offers of easy remote work, with payment first or personal details requested.
• Phone-carrier or streaming messages. Claims that a subscription failed or a SIM needs updating.

Common clues

No single clue is decisive. Look for combinations:

1. You did not expect the message, or it concerns a service you do not use.
2. A link with a strange or shortened address, as in lookalike domains.
3. Urgency, deadlines or threats.
4. A request for personal information, a login, a payment or a code.
5. An unfamiliar number sending a message that claims to be from a known person or company.
6. A generic greeting, vague details or odd formatting, though polished messages are possible now that generative AI can write fluent text.

Safer handling

• Do not tap links in unexpected texts, and do not call numbers listed in them.
• Go through a separate route. Open the organisation’s official app or type its address yourself. Use the tracking number from your original order for deliveries.
• Never share one-time codes. A code sent to you is for your login or payment; nobody legitimate will ask you to read it back, and sharing it can let someone into your account. Two-factor authentication is valuable, but only if the codes stay private.
• Do not reply, including with “STOP”, to suspicious messages from unknown senders, since replies can confirm that your number is active. Reporting and blocking is usually better.
• Check with the supposed sender. If a message claims to be from a relative, call them on their old number.
• Use filtering tools. Phones and carriers often offer options to filter unknown senders and report junk. Mobile operating systems also let you report a message as junk from within the messaging app.
• Keep your phone updated. Software updates fix weaknesses that malicious links or files try to use.

Reporting

Many countries run a short number or an official website for reporting scam texts, and carriers often accept forwarded messages. Reporting is useful because it can help block the sender, though it will not necessarily bring a reply. Check your carrier’s or regulator’s current instructions, as they differ by location.

If you tapped or replied

If you only tapped a link and nothing was entered, closing the page is often enough, but keep an eye on your accounts. If you entered a password, change it and any others that match it. If you gave card details, call your bank on a number you trust. If you shared a code, secure the associated account immediately. The steps in scam recovery steps set out a general order. Outcomes vary, so do not wait to act.