Text Message Scams: How to Recognize and Report Smishing

Text messages feel personal and urgent in a way email does not. We read them quickly, often while doing something else, and links on a small screen are hard to inspect. That is why scammers love them. Phishing by text message even has its own name: smishing.

The good news is that most scam texts follow a handful of scripts. Once you recognize them, they lose their grip.

The most common scripts

• The delivery problem. "Your package could not be delivered. Update your address here." The link leads to a page asking for a small fee and your card details.
• The unpaid toll or fine. A message claims you owe a small toll, parking fine or court fee and will face penalties unless you pay through a link.
• The bank alert. "Did you authorize this charge? Reply YES or NO." Replying leads to a call from a fake fraud department that asks for codes or passwords.
• The account lock. A streaming, shopping or email service says your account is suspended and you must sign in to restore it.
• The prize or refund. You have won something, or you are owed a refund, and just need to confirm your details.
• The job offer. Easy remote work with high pay, often for "liking" videos or reviewing products, which eventually requires you to send money.
• The friendly wrong number. A stranger texts as if they reached you by mistake, then keeps chatting. Weeks later the conversation turns to an investment opportunity. This long con can be devastating.
• The code request. Someone says they sent you a verification code by accident and asks you to forward it. That code is the key to one of your accounts.

Warning signs in any text

• It comes from an unknown number, a long string of digits or an email address.
• It creates urgency: a deadline, penalty or account lock.
• It asks you to tap a link to pay, sign in or "verify."
• The link's address does not match the organization's real website, or uses a shortened link.
• It asks for a code, a password or card details.
• Something feels slightly off, such as odd grammar or a greeting that does not use your name.

What to do instead

1. Do not tap the link or reply, not even "STOP" on an obvious scam, since replying confirms your number is active.
2. Check through a channel you trust. Open the delivery company's app, your bank's app or the toll agency's official website by typing the address yourself.
3. Report the message (see below), then delete it.

If a text seems to come from a friend or family member but asks for money or codes, call them on the number you already have.

How to report and block scam texts

• Forward the text to 7726. In the United States, major carriers accept spam reports at this number, which spells SPAM on a keypad. Your carrier may ask you to send the sender's number too.
• Use your phone's report option. Both iPhone and Android messaging apps let you report junk or spam and block the sender from the conversation.
• Report to the Federal Trade Commission at ReportFraud.ftc.gov if you lost money or want to help track the scam.
• Turn on filtering. iPhone can filter messages from unknown senders into a separate list, and many Android phones include built-in spam protection in the messaging app. Your carrier may also offer free spam filtering.

If you tapped the link or shared information

• If you entered a password, change it immediately on the real website or app, and turn on two-factor authentication.
• If you entered card details, call your card issuer using the number on the back of the card and ask about a new card and disputing charges.
• If you shared a verification code, sign in to that account right away, change the password and sign out of other sessions.
• Watch for follow-up messages, which often impersonate your bank's fraud team.

Many of the same tactics show up by email. Our guide to spotting a phishing email covers how to inspect links and senders on any device.

Frequently asked questions

Can I get hacked just by opening a scam text?

Opening and reading a text is generally safe on an updated phone. The risk comes from tapping links, downloading files or replying with information. Keep your phone's software updated.

Why do I get scam texts if I never gave out my number?

Scammers send messages to huge lists of numbers, some generated automatically and some gathered from data breaches or public sources. Receiving one does not mean you did anything wrong.

Is it safe to reply STOP?

For messages from businesses you signed up with, STOP is the normal way to opt out. For obvious scams, do not reply at all; report and delete instead.