Smishing Scams: What They Are, How They Work and How to Stop Them

Smishing Scams: What They Are and How to Stop Them

A smishing scam is a phishing attack sent by text. The sender pretends to be a bank, courier, toll operator or employer and wants you to tap a link, call a number or share a code. If you haven’t clicked, don’t. Delete the message.

The losses are real. US consumers reported losing $470 million in 2024 to scams that began with a text, five times the 2020 figure. Most fraud goes unreported, so the true number is higher.

How it works

The text creates a worry (a failed delivery, a locked account, an unpaid toll) and points you to a link or phone number. The link opens a fake page that collects your login, card details or one-time code, and the criminal uses them to take money or break into accounts.

The five most reported text scams

1. Fake package delivery. “Your parcel is on hold. Confirm your address.”
2. Task and fake job offers. Easy online work, then a request for your money.
3. Fake fraud alerts. A “bank” warns of suspicious activity and connects you to a fake fraud department.
4. Unpaid toll notices. A made-up balance, designed to steal card details.
5. Wrong-number chats. A misdirected message turns into friendship, then an investment pitch.

Also watch for code theft, where someone asks you to read back a verification code.

Red flags

• An unknown sender, or a number that doesn’t match the brand
• Urgency or a deadline
• A surprise parcel, toll or refund
• A shortened or odd link
• A request for a password, PIN or code

What to do

1. Don’t click the link or call the number.
2. Don’t reply.
3. Forward it to 7726 (SPAM) in the US, or report it at ReportFraud.ftc.gov.
4. Delete it and block the sender.

If you already clicked: change the password for that account, then your email and banking, and call your bank on the number printed on your card. Turn on multi-factor authentication and watch your statements.

In India: report unwanted commercial messages through the TRAI DND app or by calling 1909. For suspected fraud, use the Chakshu facility on the Sanchar Saathi portal. If money is already lost, call 1930 or file a complaint at cybercrime.gov.in.

For businesses

Train staff to spot these texts, and require a second check, such as a call to a known number, before any payment requested by text. Make your own messages easy to trust: use a consistent sender, link only to your own domain, never ask for passwords or card numbers, and include an opt-out.

MessageBlink, a Salesforce-native SMS and WhatsApp app, logs messages on the contact record and tracks opt-outs. Compliance still depends on how you set it up, so check your region’s rules.