How to spot a scam text message: the signs of smishing and what to do
Parcels on hold, blocked accounts, fines to pay: scam texts are getting more convincing. Here are the five signs that give them away, and what to do if you've already tapped the link.
- Level
- beginner
- Time
- 5 minutes
- What you need
- Nothing, just curiosity
Smishing is phishing by text message: a message pretending to come from a courier, your bank, the tax office or a government agency, pushing you to tap a link to “unlock” something. The wording is increasingly polished, and the senders sometimes appear in the same conversation thread as genuine messages, thanks to a technique called spoofing. That is why it pays to learn to recognise them from the content.
The five signs
Urgency. “Your account will be blocked within 24 hours”, “Your parcel will be returned to sender today”. The rush is there to stop you thinking. No bank and no courier closes an account or returns a parcel because of an unread text.
A strange link. Banks do not send links by text for security operations. If the link contains the service’s name but on an unusual domain (say “royal-mail-verify.xyz”, or a shortener like bit.ly), it is a scam.
A request for data or payment. A courier does not ask for 1.99 to “clear customs” by text. A bank never asks for PINs, one-time codes or passwords.
Odd wording and mistakes. Not always present, but phrases like “Dear customer you parcel is waiting” are a strong clue.
You weren’t expecting anything. If you haven’t ordered anything and don’t bank with that bank, the answer is simple: delete it.
What to do if you tapped the link
If you only opened the link and closed the page, usually nothing happened: modern phones do not get infected by opening a web page. If you entered data, act immediately: change the password of the service involved, call the bank to block cards and account, and turn on two-factor authentication. If you installed an app from a link (this happens on Android), uninstall it and watch your bank statements over the following days.
How to report it
Forward the message to your carrier’s spam-reporting number where one exists (7726 in the UK, US and several other countries) and report it to your national consumer or cybercrime agency. Blocking the number helps little, since it changes every time, but reporting helps get scam sites taken down faster.