Primary keyword: how to identify phishing text messages
Unexpected text messages can look like they come from a bank, delivery company, mobile provider, employer, or even someone you know. Some are harmless spam, but others are designed to steal passwords, payment details, or access to your online accounts. Learning how to identify phishing text messages can help you avoid a costly mistake.
This practical guide explains the most common warning signs, what to do when a message looks suspicious, and how to report it safely.
What is a phishing text message?
A phishing text message, sometimes called “smishing,” uses SMS or another messaging service to trick you into clicking a harmful link, opening an attachment, calling a fake support number, or sharing personal information. The message often imitates a trusted organization and creates pressure so you act before checking the details.
10 warning signs of a phishing text
1. It creates urgent pressure
Messages that say your account will be closed, your parcel will be returned, or a payment will be cancelled “today” are designed to make you react quickly. CISA lists urgent or emotionally appealing language as a common phishing sign.
2. It asks for personal or financial information
Be cautious if a text requests your password, bank details, card number, national ID, security code, or one-time passcode. The FTC advises that unexpected texts asking for personal or financial information should not be trusted.
3. The link looks strange
Look for shortened URLs, unusual domains, misspellings, extra words, or a web address that does not match the real company. A familiar logo or brand name in the message does not prove the link is genuine.
4. It claims there is a suspicious transaction
Fake fraud alerts and payment warnings are popular because they create fear. Instead of using the link in the message, open your banking app or type the company’s known website address yourself.
5. It mentions a delivery you are not expecting
Scammers often send fake parcel notifications with a small “redelivery fee.” If you are expecting a package, check the order through the retailer’s official app or website, not through the text.
6. It offers a prize, coupon, or refund
Free gift cards, unexpected refunds, and limited-time rewards can be bait. If an offer seems too good to be true and asks you to click or provide information, treat it as suspicious.
7. The sender is unknown or the number is unusual
An unknown number is not automatically malicious, but it is a reason to slow down. Be especially careful with international numbers, random group messages, or messages that pretend to be a friend using a new number.
8. It asks you to call a number in the message
Some scams avoid links and instead ask you to call “support.” Never assume that number is real. Find the organization’s contact details on its official website or on a statement you already trust.
9. It asks for a reply such as YES
A reply can confirm that your number is active or start a conversation that later becomes a social-engineering attempt. CISA recommends not replying to suspected phishing messages.
10. The message contains a link or attachment you did not expect
Do not open unexpected links or attachments, including supposed unsubscribe links. They may lead to a fake login page or harmful software.
What to do when you receive a suspicious text
- Do not click, call, reply, or open attachments. Stop before interacting with the message.
- Verify independently. Open the official app or type the company’s website yourself. Do not use contact details supplied in the text.
- Report and delete it. The FTC says you can forward unwanted texts to 7726 (SPAM), report the message through your messaging app, and report fraud at ReportFraud.ftc.gov.
- Block the sender. Use your phone’s spam or block feature. Google Messages also provides spam protection that can identify suspicious patterns and links.
- Warn others if appropriate. If the message impersonates your employer, school, bank, or a family member, let the organization or person know through a trusted channel.
If you already clicked the link
Close the page immediately and do not enter more information. If you entered a password, change it from the official website and enable multi-factor authentication. If you shared bank or card details, contact your bank using the number on your card or statement. Review account activity, save evidence, and report the incident.
Quick checklist
- Unexpected message? Pause.
- Urgent request? Verify independently.
- Unknown link? Do not open it.
- Personal or payment information requested? Do not share it.
- Suspicious text? Report, block, and delete.
Authoritative sources
This guide is based on consumer and cybersecurity guidance from the U.S. Federal Trade Commission, Cybersecurity and Infrastructure Security Agency, and Google Messages spam protection documentation. Guidance can vary by country and mobile provider, so readers should also check their local cybercrime reporting service.