What is smishing? The scam text explained, with the five you are most likely to get

Smishing in one sentence

Smishing is phishing by text message. The name is "SMS", the technical word for a text, joined to "phishing". You will also see it called a phishing text or SMS phishing.

The U.S. Postal Inspection Service describes it as a deceptive text message meant to lure you into handing over personal or financial information. The Cybersecurity and Infrastructure Security Agency (CISA) files it under social engineering, and that is the part worth remembering: nobody breaks into your phone. The text talks you into doing something yourself, usually tapping a link and typing a card number or a password into the page behind it.

The link is where the danger sits. CISA points out that a text can carry links to web pages, email addresses or phone numbers, and that one tap may open the page, start the email or dial the number.

Smishing, phishing and vishing

They are one trick arriving three ways. In CISA's definitions:

• Phishing uses email or a malicious website, posing as an organization you trust.
• Smishing uses text messages.
• Vishing uses a voice call.

There is a fourth: when the link is hidden inside a QR code, it is called quishing.

The story in the message is often the same in all of them. What a text changes is the setting. It reaches you on a small screen, where a web address is hard to read, and it sits in the same list as messages from people you know.

How big it is

The Federal Trade Commission added up the reports for 2024: people said they lost $470 million to scams that started with a text message. That is more than five times the figure for 2020, and it happened while the number of reports went down.

The five scam texts the FTC sees most

This is the FTC's list for 2024, most reported first. The sample messages are ones we wrote to show the shape, and the web addresses in them are made up.

1. The package that could not be delivered

USPS: Your parcel is on hold because the address is incomplete. Update it within 24 hours or it will be returned: usps-parcel-update.example/track

The most reported text scam of the year, usually pretending to be the U.S. Postal Service. The Postal Inspection Service gives a rule that settles it: USPS does not text you unless you first asked for updates on a specific tracking number, and even then the text "will NOT contain a link". A USPS text with a link in it is not from USPS.

2. The job offer from nowhere

Hi, this is Dana from a staffing agency. We have a remote part-time role, flexible hours, $200 to $500 a day. Reply YES for details.

The FTC describes these as unexpected texts offering work without saying what the work is. It turns out to be a series of online tasks, and it ends with requests to put in your own money.

3. The fraud alert that isn't one

Bank alert: Did you attempt a $1,249.00 purchase at an electronics store? If not, secure your account now: secure-account-review.example

A text about suspicious activity, or a big purchase you never made. It copies the look of a real bank alert on purpose. The FTC's line on this is plain: legitimate companies won't ask for information about your account by text. If you think the alert could be real, call the number on the back of your card. When the story continues with "move your money to keep it safe", you are in the script we describe in Zelle scams.

4. The unpaid toll

Toll Services: You have an unpaid toll of $6.99. Pay by midnight to avoid a $50 late fee: toll-pay-now.example

The FTC's description: a text out of the blue saying you owe tolls and must pay immediately, sometimes with a dollar amount, and a link to a page that asks for your bank or card details. The money is not the only thing at stake. The FTC warns that the page can also take personal information such as your driver's license number. Its advice is to check with your state's tolling agency, using a phone number or website you know is real.

5. The "wrong number"

Hey Anna, are we still on for dinner Thursday?

No link, no request, and you are not Anna. If you answer, the stranger is friendly and keeps the chat going. The FTC says these conversations often take on romantic undertones and can lead to investment scams and other scams. The reply that works is no reply.

What gives a smishing text away

• You were not expecting it. The FTC's descriptions keep using the same words: unexpected, out of the blue.
• It is urgent, and something bad happens if you wait: a fee, a returned parcel, a locked account. CISA lists urgent language that threatens dire consequences as a red flag.
• It asks for personal or financial information.
• The link is shortened, or the name in it is slightly wrong. CISA's own example is "amazan.com".
• It offers something for nothing. The FTC names free prizes, gift cards, coupons and low-interest credit cards.

How to check the link without opening it

The official advice is short. Don't tap links in texts you weren't expecting, and don't reply. If you think the message might be real, contact the company through a phone number or a website you already know is real.

That covers almost every case, because a real problem will also show up in the company's own app or on its own site. For the times you still want to know where a link leads:

1. Press and hold the link and choose Copy. Don't tap it. If your phone shows a small preview of the page, close it.
2. Paste it into our link checker. We open it in a browser that isn't yours, follow every redirect to the end, and tell you where it really goes, how old that site is, and whether the page asks for a login or a payment.
3. Treat the answer as a second opinion. "Low risk" means our checks found nothing wrong at the moment we looked. It is not a promise that a site is safe.

How to read a web address yourself, and why a short link tells you nothing until something follows it, is in Is this link safe?

How to report a smishing text

• Forward it to 7726 (it spells SPAM). The FTC says this helps your wireless provider spot and block similar messages.
• Use your phone's "report junk" option, which reports the text to your messaging app.
• Report it to the FTC at ReportFraud.ftc.gov.
• If it used the Postal Service's name, the Postal Inspection Service also takes these at [email protected].

Then delete it. The FTC adds that your phone may have a setting to filter and block messages from unknown senders, and that your wireless provider might offer a blocking tool of its own.

For other kinds of scams, and what each agency does with a report, see where to report a scam.

If you already tapped the link

What to do next depends on how far you got. If you opened the page and typed nothing, close it and delete the text. If you went further, these are the FTC's steps:

• You typed a password. Create a new, strong password for that account, change it anywhere else you used the same one, and turn on two-factor authentication.
• You entered card or bank details. Tell your card issuer or bank immediately. If money was taken, ask them to refund it.
• You gave your Social Security number. Go to IdentityTheft.gov to report it and get a recovery plan for your situation.
• Something was installed, or the phone behaves oddly. Update your security software, run a scan and delete what it flags, then change your passwords.

If the text led to a website, you can also report the address to us, so the next person who checks it sees the warning.

Sources: FTC: Top text scams of 2024 · FTC press release, April 16, 2025 · FTC: How to Recognize and Report Spam Text Messages · FTC: Got a text about unpaid tolls? · FTC: What To Do if You Were Scammed · U.S. Postal Inspection Service: Smishing · CISA: Avoiding Social Engineering and Phishing Attacks · CISA: Recognize and Report Phishing