Got a text that feels off? Here is how to spot scam text messages: look for unexpected contact, urgency and odd links, then check with the sender through an official app or website, never the message.
This guide is part of our wider coverage of mobile phones and gadgets.
| Item | Value |
|---|---|
| Short code for forwarding scam texts to your carrier | 7726 |
| Consumer losses to text message scams in 2024 | $470 million |
| Growth compared with the amount reported in 2020 | Five times |
| Spam texts Americans received in December 2023 (RoboKiller estimate) | 19.2 billion |
| Spam texts per person in that month | Roughly 63 |
| Usual length of a genuine SMS sender number | 10 digits |
These figures come from Guardio’s smishing guide and Security.org’s smishing guide. Figures can change, so check the source before you rely on them.
What smishing is and why it works
Smishing is a phishing message that arrives as an SMS text, and the sender is after your sensitive information. According to the National Cybersecurity Alliance, typical targets include your username and password, credit card number or national ID.
The trick is psychological pressure rather than clever technology. Guardio notes that smishing texts tend to create a sense of urgency, and that text messages also feel more personal than email.
The scale is large. Guardio reports that consumers lost $470 million to text message scams in 2024, which it says is five times the amount reported in 2020, citing FTC data reported by Cybernews. It also cites a RoboKiller estimate that Americans received 19.2 billion spam texts in December 2023, roughly 63 per person (Guardio).
Common scam text formats
Scam texts tend to follow a few familiar scripts. Knowing them makes the odd one out easier to catch.
- Fake package alerts: a text claims a delivery failed and asks for a fee or address confirmation through a link. Guardio says the real USPS will never send you a link in a tracking text unless you requested it.
- Fake bank alerts: a message warns of a suspicious charge and asks you to verify your account. Guardio points out that banks don’t ask for card numbers or PINs over text.
- Task scams: someone offers easy online work, then eventually pressures you to put in your own money to unlock your earnings.
- “Wrong number” openers: a friendly chat starts after a mistaken text and steers towards a scam.
- Government impersonation: a text claims you owe a fee or must verify personal details, yet Guardio says government agencies don’t initiate contact over text.
Navy Federal’s smishing article, which draws on the Federal Trade Commission, adds prizes or gift cards and requests to verify purchases to the list of common tactics (Navy Federal).
Warning signs in a suspicious message
Guardio says none of the warning signs is proof on its own, but two or three together should put you on alert. Check each of these before you tap anything.
- You didn’t start the conversation, such as a courier text about a parcel you never ordered.
- The message pushes you to act fast or threatens a penalty.
- The link is shortened, random or a near-miss of a real web address.
- It asks for passwords, PINs, account numbers or other sensitive details.
- The sender number is unfamiliar, and may not match the organisation’s official number.
On sender numbers, Security.org says SMS texts generally come from 10-digit numbers, while some marketing and political messages use a five- or six-digit shortcode. It adds that a text from an 11-digit number is likely to be a scam, but numbers can also be spoofed, so treat this as one clue among several (Security.org).
Spelling is a weaker clue than it used to be. Guardio says scam texts used to be full of typos but many are now polished and professional-sounding, so clean wording proves nothing.
How can you check a text without clicking?
The safest check goes around the message entirely. Guardio’s advice is that even if only one warning sign applies, clicking the link to investigate is the riskiest move you can make.
- Close the message and open the organisation’s official app, or type its real web address into your browser, then look for genuine alerts.
- Call using a number you find independently, such as the one on the back of your card. Don’t call a number provided in the suspicious text.
- For a parcel notice, enter your tracking number on the carrier’s official website.
- Paste part of the message into a search engine, because scam messages tend to circulate widely and others often report them.
Navy Federal gives the same advice: contact your bank or credit card company directly to confirm that the text came from a trusted source before sharing any account information (Navy Federal).
What to do if you already tapped the link
It happens to careful people. The Cyber Helpline says it is very easy to fall for a smishing scam, even cyber security experts can, so there is no need for shame. Acting quickly matters more.
- Don’t enter any information on the page that opened, and close it.
- Take the device you were using offline, as The Cyber Helpline advises, in case there is malicious software on it.
- Notify your financial institution, even if you submitted nothing, because Guardio says some pages collect device data on load.
- Change passwords for any accounts at risk, using a different device from the one that got hit.
- Run a security scan on your device, then watch your statements for charges you didn’t authorise.
If you gave out card details, The Cyber Helpline says you may need to cancel the card and get a new one.
Reporting and blocking scam texts
Reporting helps your carrier and other people. The National Cybersecurity Alliance says to forward suspicious SMS messages to 7726, and your carrier will then reply asking for the number the text came from (National Cybersecurity Alliance). Security.org describes the same short code as spelling SPAM.
In the USA, The Cyber Helpline says to report fraud and scams to IC3 and the FTC. It adds that although the FTC can’t act on individual reports, your report can help others (The Cyber Helpline).
Don’t reply to a scam text, even to say stop. Security.org warns that replying confirms your phone number is valid, and it suggests turning on your phone’s built-in spam filtering:
- iPhone: go to Settings, select Messages, then filter unknown senders.
- Android: open the Messaging app, tap the three dots at the upper right, choose settings, then select spam protection.
Once your messages are locked down, other practical phone guides cover how to choose wireless earbuds and how to improve smartphone battery life. The first is at how to choose wireless earbuds and the second at how to improve smartphone battery life.
Frequently asked questions
Can a scam text come from a number that looks real?
Show answer
Yes. Security.org says scammers spoof phone numbers to make texts look like they come from legitimate or familiar sources, so a believable number is not proof of anything.
Does bad spelling prove a text is a scam?
Show answer
No. Security.org lists poor spelling and grammar as a sign, but Guardio says many scam texts are now polished, so weigh the wording alongside the other signs.
Should I trust a text that claims to be from my bank?
Show answer
Treat it as unverified. Guardio says banks don’t ask for card numbers or PINs over text, so open your bank’s official app or call a number you found yourself.
Is it safe to reply to a scam text to opt out?
Show answer
Don’t. According to Security.org, replying to a smish confirms your phone number is valid. Report the message to 7726 and block the sender instead.
