Smishing: How to Spot a Scam Text and What to Do If You Clicked

Smishing is phishing by SMS text message. A scammer sends a text that pretends to be from a delivery company, toll agency, bank, retailer or government office, and tries to get you to tap a link, reply or call a number so they can steal your card details, login or money. If you get an unexpected text asking you to act quickly, don’t tap anything: check directly with the company through its official app or website, then forward the text to 7726 and delete it.

Scam texts land in everyone’s inbox, and they are written to look routine. Tapping a link in one isn’t a sign of foolishness; it’s what the message was built to make you do. What matters is what you do next.

What smishing is

The word combines SMS and phishing. It covers any scam that starts with a text, including iMessage, RCS and messages on apps like WhatsApp that behave like texts. The goal is usually one of four things:

• Your card details, entered on a fake payment page for a small “fee”.
• Your login for a bank, email or shopping account, entered on a fake sign-in page.
• A one-time code that lets the scammer take over an account.
• A conversation that leads to a larger scam, such as a fake job or investment.

Smishing is part of a family. Email scams are phishing (see how to spot a phishing email), scam calls are vishing, and scams through QR codes are quishing. Many scams use more than one, for example a text that asks you to call a “fraud line”.

Common types of smishing texts

The same few stories come up again and again. If you’ve received one of these, the specific guide goes into more depth.

Scam text	What it claims	More detail
Delivery problem	A package can’t be delivered until you confirm your address or pay a small fee.	USPS text scam and package delivery scams
Unpaid toll	You owe a toll and will face fines unless you pay now.	Toll text scam
Bank or card alert	A suspicious payment needs you to reply, tap a link or call a number.	Zelle scams and vishing
“Wrong number”	A friendly stranger who texted by mistake and keeps chatting.	Wrong number text scam
Job offer	Easy remote work with high pay, often via a recruiter you never contacted.	Job scams
Account or subscription	Your Apple, Amazon, Netflix or PayPal account is locked or a payment failed.	Apple scams and Amazon scams
Prize, refund or government payment	You’ve won something or are owed a refund, relief payment or loan forgiveness.	IRS scams

Warning signs of a smishing text

• You weren’t expecting it. You didn’t order anything, don’t use that toll road, or don’t have an account with that company.
• Urgency. A deadline, a fine, a locked account or a package about to be returned.
• A link to an odd web address, such as a long string of letters, a misspelled brand name or an unfamiliar ending. Real companies usually send you to their own domain or tell you to open their app.
• A small payment request. A tiny fee feels harmless, but the real target is your full card number.
• A request for a code. Nobody legitimate texts to ask you to send back a verification code.
• A generic greeting or no name at all, sometimes with odd spacing or spelling that helps it slip past spam filters.
• A strange sender. An email address, a random personal number or an international number instead of the short code the company normally uses.
• “Reply Y to activate the link”. Some scam texts ask you to reply so your phone will make the link clickable. Replying also confirms your number is active.

What to do if you got a scam text but didn’t tap anything

1. Don’t reply, not even “STOP”, unless you know the sender is a legitimate company you’ve signed up with.
2. Check independently if you’re unsure, using the company’s official app or a website address you type yourself.
3. Forward the text to 7726 (which spells SPAM). This reports it to your mobile carrier.
4. Use your phone’s report option. Most phones and messaging apps have a “report junk” or “report spam” option on unknown senders.
5. Delete the message once you’ve reported it.

What to do right away if you tapped the link or shared details

Tapping a link on its own usually isn’t the main risk; what you entered on the page is. Work through what applies to you.

1. If you entered card details, call your card issuer on the number on the back of the card. Ask them to block the card, issue a new one and watch for charges.
2. If you entered a password, change it on the real site straight away, and anywhere else you used the same password. Start with email and banking, and turn on two-factor authentication.
3. If you shared a one-time code, contact that company through its official app or website immediately, because the scammer may be signing in. Our my account was hacked guide covers the recovery steps.
4. If you gave personal details like your date of birth or Social Security number, consider a credit freeze and read how to prevent identity theft.
5. If you downloaded something from the link, especially on Android, delete the app, run a security scan and check your phone’s settings for unfamiliar profiles or apps with broad permissions.
6. Keep the text. Take a screenshot showing the sender and link before you delete it, and note anything you paid.

When you call your card issuer, you can keep it simple:

I entered my card number on a website I reached from a scam text. I’d like to block this card, get a replacement and dispute any charges I didn’t make.

Where to report smishing

• Forward to 7726 to alert your mobile carrier.
• ReportFraud.ftc.gov to report the scam to the Federal Trade Commission.
• The FBI’s IC3 (ic3.gov) if you lost money or the scam continued online.
• The company being impersonated, through its official website. Many large brands have a page for reporting fake texts in their name.
• The USPS Postal Inspection Service if the text pretended to be from USPS.
• IdentityTheft.gov if someone has used your personal details.

Our guide on how to report a scammer lists every route in one place, including for readers outside the US.

Can you get your money back?

Often, yes, if you paid by card and act quickly. Most smishing scams collect a card number rather than asking for a transfer, which means you can dispute unauthorized charges with your card issuer. The sooner you report, the better your chances.

It’s harder if the text led to a larger scam, such as a job or investment scheme where you sent money through a payment app, a bank transfer, gift cards or crypto. Those are often difficult or impossible to reverse. Report them to your bank or app immediately anyway, in case the funds can still be stopped.

Be cautious of anyone who contacts you afterward offering to recover the money for a fee. That is a common follow-up scam, and our recovery scams guide explains how it works.

Worked example: two texts in one afternoon

This is an illustrative scenario, not a real person. Marcus gets a text saying a package is on hold and needs an address update. He’s expecting a delivery, so he taps the link, sees a page that looks like a courier site and pays a small “redelivery fee” with his debit card.

An hour later, a second text arrives, apparently from his bank, asking whether he approved a large purchase and giving a number to call. Now suspicious, he doesn’t call it. He opens his banking app, sees a pending charge he didn’t make, and calls the number on the back of his card. The bank cancels the card, disputes the charge and sends a new one. Marcus forwards both texts to 7726, reports them at ReportFraud.ftc.gov and checks his real delivery in the retailer’s app, where it’s arriving normally.

The second text wasn’t a coincidence. Scammers often follow up a stolen card with a fake “fraud alert” to squeeze out more, which is why checking through your own app mattered.

How to protect yourself from scam texts

• Track deliveries and bills in official apps rather than through text links. Then you’ll know what’s real.
• Turn on spam filtering. iPhone and Android both offer options to filter messages from unknown senders, and most carriers offer free spam blocking.
• Use a credit card or virtual card number for online payments where you can, since they’re usually easier to dispute.
• Turn on two-factor authentication using an authenticator app or passkey where possible, so a stolen password alone isn’t enough.
• Talk to family members, especially older relatives and teenagers, about the common scam texts. A quick “check the app, not the link” rule goes a long way.
• Limit where your number is published. Our guide on how to remove your phone number from the internet explains how to reduce how easily scammers can find it.

If scammers are texting people in your business’s name

Small businesses are impersonated too, with fake texts about invoices, bookings or refunds sent to customers. If customers tell you about texts you didn’t send, publish a notice on your website and social pages explaining how you really contact people, report the texts, and see our guide on online impersonation. If confused customers start leaving angry reviews about the scam, our review management service can help you respond clearly and report reviews that break platform rules.

Common mistakes to avoid

• Replying to “unsubscribe”. It confirms your number is active and can lead to more texts.
• Calling the number in the text. Use the number on your card or the company’s official site.
• Assuming a small fee is low risk. The fee is bait; your card number is the prize.
• Trusting a text because it’s in an existing thread. Spoofed messages can sometimes appear alongside real ones from the same sender name.
• Staying quiet. Reporting to 7726 and the FTC helps carriers and investigators block the next wave.

Frequently asked questions

What is smishing?

Smishing is phishing by text message. Scammers send texts pretending to be a trusted company or agency to get you to tap a link, share details or send money.

What happens if I just open a scam text?

Opening and reading a text is generally not dangerous on its own. The risk comes from tapping the link, entering information, downloading something or replying.

How do I report a smishing text?

Forward it to 7726 to report it to your carrier, use your phone’s report junk or spam option, and report it at ReportFraud.ftc.gov. If you lost money, also contact your bank and report at ic3.gov.

Why am I getting so many scam texts?

Scammers send texts in bulk to lists of numbers, some generated automatically and some taken from data leaks or people search sites. Getting them doesn’t mean you did anything wrong.

Should I reply STOP to a scam text?

No. Replying confirms your number is active. Report and delete it instead. Only reply STOP to texts from companies you know you signed up with.