“Your package couldn’t be delivered — click here.” “Your bank account is locked.” Sound familiar? Smishing (SMS phishing) is now the #1 phone scam vector, and the messages are getting scarily convincing. Here’s how to spot them in seconds.
How Can I Tell If a Text Message Link Is a Scam?
Run every unexpected text link through these checks: 1) Did you expect it? Legitimate companies don’t text links out of the blue about accounts you didn’t just interact with. 2) Does it create urgency? “Act now,” “account suspended,” “final notice” — urgency is the scammer’s favorite tool. 3) Check the sender — banks text from short codes, not random 10-digit numbers or email addresses. 4) Hover the link (long-press on mobile) — if the URL doesn’t match the company’s real domain exactly, it’s fake.
Red Flags Checklist
- Urgency + link: “Your account will be closed in 24 hours — verify now.” Real companies don’t do this by text.
- Too-good offers: “You’ve won a $500 gift card!” — you didn’t enter anything; there’s no prize.
- Package delivery texts you didn’t order from — the #1 smishing theme. USPS/FedEx/UPS don’t text tracking links unless you signed up for alerts.
- Wrong company details: “Chase Bank” texting about your Wells Fargo account, or vice versa.
- Asking for personal info: No legitimate text asks for your SSN, full card number, or passwords.
- Slightly-off URLs: amaz0n.com, chase-secure.net, usps-track-package.com — close but wrong.
What to Do With a Suspected Scam Text
- Don’t click. Don’t reply. Even “STOP” confirms your number is live — just delete it.
- Verify independently: Open the company’s real app or type their URL manually — never use the text’s link.
- Report it: Forward to 7726 (SPAM) — works on all major US carriers and feeds their spam filters. Also report to reportfraud.ftc.gov.
- Block the number — though scammers rotate numbers, so blocking is whack-a-mole.
If You Already Clicked
Don’t panic, but act fast: if you entered credentials, change that password immediately (from a different device) and enable 2FA. If you entered card details, call your bank. If you downloaded anything, run a malware scan. And if your email might be exposed, check whether your email was hacked. Speed matters — the first hour is when damage happens.
Anatomy of a Smishing Attack (Real Example)
Here’s how a real attack unfolds: 1) Tuesday 2 PM: you get “USPS: Your package could not be delivered. Reschedule: usps-track-pkg.com” — you are expecting a package (they blast millions; statistics do the targeting). 2) You click: a pixel-perfect USPS page (cloned in 10 minutes with free tools). 3) “Verify your address”: name, address, then “a $0.30 redelivery fee” — enter your card. 4) Done: they have your card + personal details; the $0.30 charge tests the card’s validity. Why it works: expected context (packages), tiny ask ($0.30 — below suspicion), professional design, and urgency. The defense at each step: unexpected link (step 1 — delete), URL check (step 2 — wrong domain), card request via text link (step 3 — never). One break in the chain stops the attack.
Smishing vs. Phishing vs. Vishing (Know All Three)
Same criminals, three channels: Smishing (SMS): fake package/bank texts with links — the fastest-growing vector. Defense: never click unexpected links (this guide). Phishing (email): fake invoices, “account suspended” emails — more sophisticated, often targeted. Defense: check sender domains, never log in via email links. Vishing (voice): “This is the IRS” calls, fake tech support — preys on panic and authority. Defense: hang up, call back on a known number. The common thread: urgency + a requested action (click, pay, share info). The universal defense: slow down, verify through a separate channel, and remember that legitimate organizations don’t operate via surprise contacts demanding immediate action. Teach the pattern, not the examples — examples evolve; the urgency-action pattern doesn’t.
If Money Already Left (Damage Control)
Act in this order: 1) Call your bank NOW — the first hour is when reversals work; debit card fraud reported within 2 days limits liability to $50 (after 60 days: unlimited). 2) Credit cards: dispute the charge — $0 liability for fraud, and the bank’s problem to solve. 3) Wire transfers: call the FBI’s IC3 (ic3.gov) immediately — wires can sometimes be recalled within 24 hours. 4) Gift cards: call the card issuer with the numbers — occasionally freezable, usually gone (this is why scammers love them). 5) File reports: reportfraud.ftc.gov + local police (needed for bank disputes). 6) Freeze your credit (all three bureaus, free) if personal info was shared. Then: enable 2FA everywhere and check email compromise signs — one breach enables the next.
Teaching Kids About Scam Texts (The Conversation)
Kids get scam texts too — prepare them: The age-appropriate version: “If a text has a link and you weren’t expecting it, don’t tap — show me first.” What targets kids: fake “free Robux/V-Bucks” texts, “you won a phone” scams, and social media login theft. The practice: show them real examples (redacted) — “spot the scam” is a game kids enjoy. The rule: never enter passwords from a text link, ever — go to the app directly. Parental controls: Apple’s Communication Safety and Google Family Link flag suspicious contacts — enable them. The deeper lesson: skepticism as a skill — “too good to be true” applies at every age. Kids who learn this now become adults who never fall for it.
The 5-Second Smish Test (Memorize This)
For every unexpected text link, ask: 1) Expected? (Were you waiting for this?) 2) Urgent? (Does it demand immediate action?) 3) Sender? (Short code or known number — not a random 10-digit?) 4) URL? (Long-press — does the domain match exactly?) 5) Asking? (Does it want personal info or payment?) Two “wrong” answers = delete. Teach it as a rhyme: “Expected, Urgent, Sender, URL, Asking.” Five seconds, five questions, zero scams. Make it reflex; scammers rely on reflex’s absence.
The Anatomy of a Smishing Attack
A typical smishing operation works like this: attackers buy bulk SMS services (legitimate infrastructure, abused), blast millions of texts with a lure (package delivery, bank alert, prize), and direct victims to phishing sites that mimic real companies. The sites harvest credentials, card numbers, or install malware — all within minutes, before the domain gets blacklisted.
The economics explain the volume: sending a million texts costs hundreds of dollars; a 0.1% success rate yields 1,000 victims. Stolen bank credentials sell for $10–$100 each on criminal markets; a single good catch (business email compromise via a phished password) can net thousands. It’s industrial-scale fraud, not targeted hacking.
Understanding the machine helps you defeat it: every smishing text needs you to (1) trust the sender, (2) feel urgency, and (3) click without verifying. Break any link in that chain — especially #3 — and the attack fails regardless of how convincing the message looks.
Frequently Asked Questions
Why do scam texts come from real-looking numbers?
Caller ID spoofing is trivial with VoIP technology — scammers display any number they choose, including your bank’s real number or your own area code. Never trust the displayed number; verify through official channels.
What should I do with a scam text?
Don’t click, don’t reply. Screenshot it, forward to 7726 (SPAM) to report to carriers, then delete and block the number. Report to the FTC at ReportFraud.ftc.gov if it impersonated a company or cost you money.
Can opening a text message infect my phone?
Just opening a plain text: essentially no on modern phones. The danger is in links (phishing/malware sites) and attachments (rare via SMS, more common via RCS/MMS). Preview links by long-pressing instead of tapping.
Why are package delivery scams so common?
Everyone orders online, so the lure is universally relevant — and tracking numbers create plausible urgency. Carriers never ask for payment or personal details via text link. Track packages through the official app or website only.
Are iPhone users safe from smishing?
No — iPhones receive the same texts. iMessage’s filtering helps slightly, and iPhones resist the malware payloads better, but credential phishing works identically on any phone. Vigilance is platform-independent.
My elderly parent keeps falling for these. How do I help?
Set up spam filtering on their phone, add yourself as a contact they can forward suspicious texts to, and establish a rule: never click links in texts — call the company instead. Consider a call-screening service. Patience and repetition work better than lectures.
The bottom line
Unexpected link + urgency = scam until proven otherwise. Verify through the real app, never the text’s link. Forward junk to 7726, and remember: no bank, carrier, or delivery company handles real problems via surprise text links. When in doubt, delete it — a real issue will reach you another way.
8 Comments