What is SMS fraud (smishing)?
Smishing — SMS phishing — is one of the fastest-growing forms of fraud worldwide. Criminals send text messages impersonating banks, delivery companies, government agencies, or prize organizations to steal money or personal information.
Unlike email, SMS messages feel more immediate and personal. Most people open a text within 3 minutes of receiving it, making smishing particularly effective. In 2024, reported losses from SMS scams exceeded $330 million in the United States alone, according to the FTC. Globally, the number is several times higher.
What makes SMS scams especially dangerous is that mobile users often can't hover over links to preview the destination before clicking — unlike on desktop. One tap can lead to a credential-stealing page or malware download.
Most common SMS scam types
Fake package delivery notifications
You receive a text from "DHL," "FedEx," or "USPS" saying a package couldn't be delivered and a small customs fee ($2–$5) is required. The link leads to a fake page that steals your card details. Neither the package nor the fee is real.
Bank and card alert scams
Texts claiming your card has been blocked, a suspicious transaction was detected, or your account needs verification. They include a link to a fake banking page. Your real bank will never ask you to log in via an SMS link.
Prize and gift card scams
"You've won a £500 gift card — claim it now before it expires!" You didn't enter any competition. The link asks for personal details or a small "processing fee" to claim the non-existent prize.
Government and tax authority impersonation
Texts claiming to be from the IRS, HMRC, or other tax authorities threatening arrest, fines, or legal action unless you call a number or pay immediately. Government agencies do not contact you via SMS about legal matters.
Wrong number scams
A seemingly innocent "sorry, wrong number" text that evolves into a conversation, eventually leading to investment opportunities (often crypto) or romance fraud.
7 signs a text message is a scam
- You weren't expecting it: A package you didn't order, a prize you didn't enter, a bank alert for a transaction you didn't make.
- There's a link: Legitimate alerts from banks rarely include clickable links. When they do, they direct you to your official app, not a website.
- The link uses a short URL: bit.ly, tinyurl, or similar shorteners hide the real destination.
- It creates urgency: "Expires in 2 hours," "Final notice," "Act now." Pressure is a manipulation tactic.
- It asks for a fee: No legitimate delivery company charges customs fees via SMS link.
- The sender is an unknown number: Real companies typically use consistent short-code sender IDs, not random phone numbers.
- Poor grammar or unusual phrasing: Even small errors are red flags, especially in messages claiming to be from large corporations.
What to do if you receive a suspicious text
- Do not click any links.
- Paste the message into our SMS scam checker above for an instant risk assessment.
- If it claims to be from your bank, open your bank's official app directly to check your account.
- If it claims to be about a delivery, track the package directly on the carrier's official website.
- Report the scam text: in the UK, forward to 7726 (free, works on all major networks). In the US, forward to 7726 (SPAM) or report to the FTC at reportfraud.ftc.gov.
- Block the sender on your phone.
What to do if you clicked a link in a scam text
- If you entered any information: Contact your bank immediately to freeze your card or account.
- Change your passwords on any account where you used the same credentials.
- Enable 2FA on all important accounts.
- Check your phone for malware — run a mobile security scan.
- Monitor your credit for unauthorized activity over the next weeks.