Smishing: How to Spot and Avoid SMS Scam Messages

Smishing, a blend of "SMS" and "phishing," is fraud carried out through fake text messages. The message usually looks as if it comes from a courier, bank, government agency or payment service and pushes you to tap a link or hand over information in a hurry. In this article we explain how to recognize smishing messages and how to protect yourself.

How does smishing work?

The scammer's goal is to make you act without thinking. The message triggers panic, curiosity or the thrill of a prize and steers you to a fake page. There you are asked for a password, card details or a verification code. Whatever you enter goes to the scammer.

Messages are mostly sent in bulk, so the sender does not need to know who you are. If your number appears in a leak or a list, a message can reach you too. Some messages are more personal and may carry your name or details that resemble a real order. That is why "it has my name in it" is not a sign of trustworthiness.

Common smishing scenarios

Topics change over time but the pattern stays the same. Watch for these:

• Delivery notice: "Your parcel could not be delivered, update your address."
• Bank alert: "There is suspicious activity on your account, verify now."
• Payment or tax debt: "You have an unpaid balance and a penalty will apply."
• Prizes and giveaways: "You won a gift, tap to claim it."
• Account closure warning: "Your account will be suspended, log in now."
• A 'wrong number' text from a stranger: The aim is to start a chat and build trust.

What they all share: urgency, threats or a big reward, and a push to take you to the link inside the message.

Tips for spotting a smishing message

One sign alone may not be enough; the more signs you see, the higher the risk:

1. An unexpected message: Be suspicious if a parcel you did not order or a bank you do not use contacts you.
2. Urgent or threatening language: Pressure phrases such as "within 24 hours," "immediately" or "your account will be closed."
3. An odd link: Shortened links, or domain names that resemble an official address with slightly different letters.
4. A request for information: Real organizations do not ask for passwords, card numbers or verification codes by SMS.
5. Language and spelling mistakes: Not always, but broken sentences are a clue.
6. A strange sender: A random number, or a sender name imitating an official body. Sender names can be faked too, so they are not proof of trust on their own.

If you are not sure, do not reply and do not tap the link. Check the situation using the organization's official app or an address you type yourself.

What if you tapped or gave information?

Anyone can make a mistake; what matters is acting fast:

1. Do not enter more information and close the page.
2. If you gave a password, change it right away through a safe channel. If you reused it elsewhere, change it there too.
3. If you shared card details, call your bank and have the card blocked.
4. If you shared a verification code, sign out of the account's sessions and review its two-step verification settings.
5. If you installed an app on your phone, remove it and scan the device with a trusted tool.
6. Report the message to your bank, carrier or the relevant organization, then delete it.

Daily habits that protect against smishing

• Open the app instead of tapping SMS links. Check courier or bank notices in the official app.
• Use a password manager. It will not autofill your saved password on a fake page, which is a warning sign in itself.
• Use a passkey or authenticator app on critical accounts. Even if the password is stolen, the account does not open. For a comparison of methods, see our article on two-step verification.
• Filter unknown numbers and spam. Turn on your phone's "filter unknown senders" and spam reporting features.
• Tell the people around you. Older family members are frequent targets; going through example messages together helps a lot.
• Verify the message. Contact the organization on an official number you already know; do not call the number in the message.

Do not hand out your number everywhere

One reason smishing messages reach you is that your number sits in many lists and databases. Typing your real number into every sign-up form makes it easier to receive spam and phishing texts. We covered this in more depth in why you should not share your phone number everywhere.

For quick trials, a second account or test sign-ups, you can use a single-use virtual number instead of your real one, so your main number does not end up on a marketing list. You can browse current services and countries on the pricing page. Keep in mind that a virtual number is not permanent and some platforms may restrict them, so follow the terms of the service you use. This is not a complete answer to smishing on its own; the real protection is careful behavior and strong verification methods.

Protecting your family and circle

Smishing works best in careless moments: on a busy day, while checking the phone in a hurry, or for someone new to technology. That is why protection is not only your concern but your circle's too.

• Set a simple rule with your family, such as "show me before you tap a link in a text."
• Show older relatives examples of fake messages and explain that a bank does not ask for codes, passwords or card details by SMS.
• Turn on unknown-sender filtering and app installation restrictions on children's phones.
• When you receive a suspicious message, share a screenshot with the people close to you so the same message does not catch someone else.

When you are unsure about a message, waiting five minutes costs nothing; a genuine notice usually shows up in the official app as well.

Frequently asked questions

What is the difference between smishing and phishing?

Phishing is the general term and can happen over email, phone, social media and more. Smishing is the version that happens through SMS (text messages).

I only tapped the link and entered nothing. Am I in danger?

Most of the time, merely tapping does little harm, but rare risks such as device or browser vulnerabilities exist. Close the page immediately, delete anything you downloaded and keep your device up to date.

The message looks like it came from a real organization's number. Could it still be fake?

Yes. Sender names can be imitated, and sometimes a fake message even lands inside a genuine message thread. Look at the content and what is being asked, and trust the official app rather than the link.

Where can I report smishing messages?

You can report them to your carrier's spam reporting number or app, to the organization concerned and to your bank. The "report as spam" option on your phone also helps. For more information, see our frequently asked questions page.