How to Spot Scam Text Messages (Smishing)

•
My Technician
SecurityPrivacyScamsPhishing

The Problem

"Your parcel is held—pay £1.99 to release it." "Your bank account is locked, tap here to verify." These scam texts—known as smishing (SMS phishing)—land on millions of phones every day. They work because a text feels personal and urgent, and the link is just one tap away. But like email phishing, smishing leaves the same tell-tale fingerprints once you know what to look for.

What Smishing Is Trying to Do

Every scam text wants one of three things:

  • Your login or card details, via a fake website that looks real.
  • A small payment (a "delivery fee" or "fine") to capture your card.
  • Malware, by getting you to install an app or "tracking" tool.

It's the same con as email phishing, just delivered by text.

Red Flag 1: An Unexpected Link

The single biggest warning sign is a link you weren't expecting. Real companies rarely text you a link to log in or pay. Be especially wary of shortened links (bit.ly and similar) that hide the real destination, and addresses with odd spellings or extra words.

The safe habit: never tap a link in an unexpected text. If it claims to be your bank or a courier, open their official app or type their website yourself.

Red Flag 2: Urgency and Threats

Scam texts manufacture panic so you act before thinking:

  • "Your account will be suspended in 24 hours."
  • "Final notice—respond now to avoid a fine."
  • "Suspicious login detected, verify immediately."

A genuine company gives you time and won't threaten you over a single text.

Red Flag 3: It Doesn't Quite Add Up

Look for the mismatches:

  • A delivery text for a parcel you never ordered.
  • A "bank" text that doesn't address you by name, or comes from a random mobile number.
  • Spelling and grammar mistakes.
  • A request for information the company already has (your full card number, PIN, or password).

No legitimate bank will ever ask for your full PIN, password, or one-time code by text.

The Most Common Scam Texts

  • Fake delivery: "Your package couldn't be delivered—pay a fee / confirm your address."
  • Bank alerts: "Did you make this payment? Reply NO," then a "fraud team" calls to "help" you move money.
  • Tax or government: "You're owed a refund" or "you owe a fine."
  • Prize/lottery: "You've won! Claim before it expires."
  • "Mom/Dad, I lost my phone": a stranger posing as your child asking you to message a new number and send money.

What to Do When You Get One

  1. Don't tap the link and don't reply—even "STOP" confirms your number is active.
  2. Don't call any number in the message.
  3. Verify independently: contact the company through their official app or the number on your card or their real website.
  4. Delete it.

The Bank "Safe Account" Scam

This one deserves special attention because it's so convincing. A text or call claims your account is compromised and that you must move your money to a "safe account" they provide. This is always a scam. Your real bank will never ask you to transfer money to keep it safe. Hang up and call your bank directly using the number on your card.

Report and Block

  • Most countries have a spam-text reporting service—in the UK and many others, forward the text to 7726 (it spells "SPAM"). Your carrier uses it to block scammers.
  • Block the number afterward.
  • Report fake bank texts to your bank's fraud team.

If You Already Tapped or Paid

Don't panic—act in order:

  1. If you entered a password, change it now from a trusted device; use unique passwords via a password manager.
  2. If you typed card details, call your bank to freeze the card.
  3. If you installed an app on your PC, run a full scan—see remove a virus or malware. On a phone, uninstall the app and use your device's built-in security scan.
  4. Turn on two-factor authentication so a stolen password isn't enough.

Your Three-Second Text Check

  1. Was I expecting this? (Unexpected = suspicious.)
  2. Is it rushing me? (Urgency is a red flag.)
  3. Where does the link really go? (Don't tap—go direct instead.)

Treat every surprise text with a link the way you'd treat a stranger at your door asking for your keys. A moment's pause is all it takes to stay safe.