Smishing Explained: Common Text Message Scams and How to Spot Them

Text messages feel personal and urgent, which makes them a favorite tool for scammers. Smishing texts are cheap to send in bulk and only need a small share of people to fall for them. They've also become more convincing, with realistic sender names, official-looking links and messages timed around holidays, tax season and travel. This guide covers the scams people in the US, UK and Canada see most, the patterns that give them away, and what to do if you've already clicked.

What is smishing?

Smishing combines SMS and phishing. A scammer texts you pretending to be a trusted organization, such as a delivery company, toll agency, tax authority, retailer or bank, and tries to get you to tap a link, call a number or reply with information. The goal is usually card details, login credentials, a one-time code, or installing a malicious app.

Many messages now arrive through iMessage or RCS rather than plain SMS, sometimes from email addresses or international numbers. The delivery method changes; the playbook doesn't.

The fake websites behind these links are often near-perfect copies of the real thing, complete with logos and a padlock icon in the address bar. The padlock only means the connection is encrypted, not that the site is genuine, so judge the site by its exact web address instead.

Which scams are most common right now?

The specific brands change, but the themes repeat. These are the ones people in the US, UK and Canada report most often.

How do you spot a smishing text?

Real organizations sometimes text, so the question is whether this text behaves like them. Look at the link, the urgency and what's being asked.

• Urgency or threats: pay today, account closed, fines, arrest.
• Links that don't match the official domain, use odd spellings or URL shorteners.
• Requests for card numbers, passwords or one-time codes.
• Small payments for big problems, like a redelivery fee.
• Sent from a random number or email address rather than a known short code.
• Messages about things you don't use, like a toll account you don't have.

What should you do with a suspicious text?

Don't tap links and don't reply, even with STOP, because replying confirms your number is active. If you think the message might be real, open the company's official app or type its website address yourself, or call the number on your card or bill. Then report the text and delete it.

In the US, UK and Canada you can forward spam texts to 7726, which spells SPAM on a keypad; carriers use the reports to block senders. In the US you can also report to the FTC at ReportFraud.ftc.gov. In the UK, report fraud to the national fraud reporting service. In Canada, report to the Canadian Anti-Fraud Centre. iPhone and Android messaging apps also have a Report Junk or Report spam option.

What if you already clicked or paid?

If you only opened the page, close it and don't enter anything. If you entered card details, contact your card issuer using the number on the back of the card. If you entered a password, change it everywhere you used it and turn on two-factor authentication. If you shared a one-time code, assume the related account is at risk and secure it immediately.

Reducing how widely your number is shared helps over time. Fewer sign-ups linked to your personal number means fewer leaked databases that scammers can mine. For apps you don't fully trust, verifying your own account with a separate number keeps your personal one cleaner. Noir SMS rents temporary numbers for exactly that kind of one-time verification; they receive SMS only and are recycled later, so don't use them for important recovery.