Reviewed by the Foxmole editorial team · 2026-07-29
On this page
Key takeaways
- A scam text (“smishing”) impersonates a trusted service to get a tap, a payment, or a code.
- The tells: urgency, a link, and a request that a real company wouldn’t make by text.
- Never tap the link, go to the app or website yourself.
“Smishing” is just phishing by text message. It’s exploded because texts feel personal and urgent, and a single tap can land you on a convincing fake page.
What a scam text looks like
- “Your parcel is held, pay a small fee to release it.”
- “Your bank has detected suspicious activity. Verify here: [link]”
- “You’re due a tax refund. Claim now: [link]”
- “Is this you in this photo?” with a shortened link.
The tells
- Urgency or a threat, act now or lose something.
- A link, often shortened, that doesn’t match the real company.
- A request a real company wouldn’t make by text, a password, a full card number, a code.
- An unknown or spoofed number.
What to do
- Don’t tap the link. Open the company’s app or type its address yourself.
- Don’t reply (even “STOP” confirms your number is live to some scammers).
- Report it: in many countries you can forward scam texts to 7726 (spells “SPAM”), and report to your carrier and local fraud authority.
- Delete it.
If you already tapped or shared something
Change any password you entered, turn on two-factor authentication, and watch your accounts. If you shared card details, contact your bank.