A text message that says a package could not be delivered, a toll is overdue or a bank account has been locked can look routine on a busy day. The people who send them are betting on exactly that. This kind of scam, which uses text messages to trick people into giving up information or money, is called smishing, a blend of “SMS” and “phishing.” It has become one of the most common forms of fraud because texts feel personal, arrive on a device people check constantly and are easy to send in bulk. Knowing the common patterns, and having a simple routine for responding, makes these messages much less effective.
What is smishing?
Phishing is the practice of impersonating a trusted organization to steal sensitive information. Smishing does the same thing by text. The message usually includes a link or a phone number, and the goal is to get the recipient to do one of several things: enter a username and password on a fake website, provide a credit card number or Social Security number, pay a bogus fee, or install malicious software. Sometimes the first message is only a hook to start a conversation, after which the scammer asks for more.
The senders may spoof phone numbers or use email-to-text gateways, and messages may come from a number that looks unfamiliar or oddly formatted. The content changes as scammers adapt, but the structure stays the same.
What are the most common scripts?
Several themes show up again and again:
- Package delivery problems. A message claims a shipment could not be delivered because of an incomplete address or a missed attempt, and asks for a small fee or a click to reschedule. The scam works because many people are expecting a package.
- Unpaid tolls or traffic tickets. A text says there is an outstanding toll balance and a late fee will apply unless the recipient pays right away. These messages often name a real toll system, even when the recipient has never used it.
- Bank and payment alerts. A message says there is suspicious activity on an account or that a card has been locked and asks the recipient to “verify” by clicking a link.
- Prize and refund offers. A text claims a refund, a tax rebate or a gift is waiting.
- Job offers. A recruiter sends an unsolicited message promising easy pay for little work, which can lead to requests for personal information or money.
- Wrong number openers. A friendly message that seems to be sent to the wrong person is meant to start a conversation that later leads to a fake investment or romance scheme.
- Impersonation of officials. Messages that claim to come from a government agency, a utility or a company’s executive and demand payment or gift cards.
What are the warning signs?
No single sign proves a text is a scam, but several together should raise suspicion.
- Urgency. The message insists on action within hours, threatens late fees or says an account will be closed. Real organizations rarely demand instant payment by text.
- An unexpected message from an organization. A toll notice from a state the recipient has not visited, or a delivery notice with no order, is a strong red flag.
- A link that does not match. The web address may mimic a real one with slight changes, extra words or an unusual ending. Shortened links hide the destination.
- A request for sensitive information or payment by unusual means. Gift cards, wire transfers, cryptocurrency and payment apps are favorites of scammers, because the money is hard to recover.
- Poor grammar or odd formatting. Not all scams have these, but many do.
- A generic greeting. Messages that do not use a name, or use the wrong one, deserve caution.
What is the safe way to check a message?
The best habit is to avoid interacting with the message at all. A simple routine works well:
- Do not click links or call the number in the text. Even opening a link can expose a device to risk, and replying confirms that the number is active.
- Go to the source directly. If the message claims to be from a toll agency, log in to that agency’s official website by typing its address or using a saved bookmark. For a package, open the carrier’s official app or tracking page and enter the tracking number. For a bank, call the number on the back of the card.
- Check with the organization. Most legitimate organizations do not demand payment by text and will confirm whether a notice is real.
- Pause. Scams depend on speed. Taking a few minutes to verify breaks the spell.
Government agencies, banks and delivery companies generally do not ask for passwords, full Social Security numbers or card numbers by text, and they do not demand payment by gift card.
What if someone already clicked or replied?
Quick action can limit the damage. If a person entered a password, change it right away on that service and anywhere else it is used, and turn on multi-factor authentication. If card details were entered, call the card issuer to freeze the card and dispute charges. If a Social Security number was provided, consider placing a fraud alert or credit freeze with the credit bureaus and review credit reports. If a link was opened and the phone behaves strangely, running a security scan or contacting the carrier or a repair service may be advisable. Anyone who sent money should contact the bank or payment service immediately, since recovery is more likely if the report is quick.
How do you report scam texts?
Reporting helps carriers block messages and helps law enforcement spot patterns. Several routes exist:
- Forward the text to 7726, which spells “SPAM” on a keypad. Wireless carriers use these reports to block similar messages.
- Use the phone’s built-in reporting tool. Many phones have an option to report junk or spam messages.
- File a report with the Federal Trade Commission through its fraud reporting website.
- File a complaint with the FBI’s Internet Crime Complaint Center, especially when there was financial loss or the scam involved a larger scheme.
- Notify the impersonated organization. A bank, delivery company or agency may want to know that its name is being used.
After reporting, delete the message and block the number.
What other steps reduce the risk?
Some protections work in the background. Keeping the phone’s software updated closes security holes, and settings that filter unknown senders can reduce unwanted messages. Using a password manager helps because it will not fill in a password on a lookalike site. Multi-factor authentication limits the damage when a password is stolen. Families can agree on a code word or a way to verify requests, since scammers sometimes use a stolen identity or a cloned voice. Privacy settings that limit how personal data is shared can reduce how much scammers know, a topic explored in your privacy rights under the CCPA and CPRA.
Who is most at risk?
Anyone can be fooled, and scammers target people across ages and incomes. Older adults and people in difficult circumstances can be especially vulnerable to threats and urgent appeals, while younger adults may be targeted through fake job offers and online marketplaces. Small businesses are also targeted, for example through messages impersonating a supplier or a bank. Owners who handle payments might review the practices discussed in how to register a business in California and make verifying payment requests part of routine procedures.
Scam texts are a nuisance, but a few habits, which are not to click, to verify independently and to report, defuse most of them. The aim is not to be perfectly vigilant, but to build a reflex of slowing down when a message pushes for speed.
Sources: Federal Trade Commission; Federal Bureau of Investigation Internet Crime Complaint Center; Federal Communications Commission; Consumer Financial Protection Bureau
