Smishing is phishing delivered by text. Scammers send messages that appear to come from your bank, a delivery service, or another trusted source, then use urgency and fake links to steal your login credentials or personal information. This article explains how smishing works, how to identify suspicious texts, and the steps you can take to protect yourself and reduce unwanted messages.
Smishing is a type of phishing attack that uses SMS or text messages to trick recipients into revealing sensitive information, such as passwords, credit card numbers, or personal account data. As more people manage their finances from their phones, smishing has become one of the most common forms of financial fraud.
How Smishing Works
1. Scammers send an urgent-sounding text message to thousands of phone numbers across an area code or geographic region.
2. The message is designed to appear as though it comes from a trusted source, such as your credit union, a shipping carrier or a government agency. It typically includes a link that opens in your phone’s mobile browser.
3. If you open the link, you are directed to a convincing fake login page and prompted to enter your username and password.
4. Once you provide your credentials, the scammer records them and attempts to access your real account.
If the scammer is successful, they can transfer funds out of your account to an external account, sometimes within minutes.
A note about modern smishing: AI tools now allow scammers to generate highly personalized, polished messages with no obvious spelling errors or awkward phrasing. Do not rely on poor writing as the primary indicator that a message is fake. Focus instead on the red flags below.
Identifying Smishing Texts
Watch for these warning signs:
- Unexpected urgency, such as account locked alerts, package delivery failures, or time-sensitive prize claims
- Links that do not match the official website address of the organization they claim to represent
- Requests for login credentials, account numbers, Social Security numbers or one-time verification codes
- Messages that arrive from an unfamiliar number or from what appears to be an email address rather than a phone number
- Greetings that use your name in an unusual way or that feel slightly off in tone
Common Smishing Examples
Before responding to any email that asks you to take action:
- Prize or money award: “Congratulations! You have won a $500 gift card to Target. Click here to claim your reward.”
- Delivery notification: “Hello [Name], your shipment from UPS will arrive today. Click here to track your package.”
- Account verification: “Your Firefighters First account has been locked for suspicious activity. Please log in here and verify your account.”
- Gift card scam: “Hey, this is [Name]. I am in a meeting but need you to order 5 Amazon gift cards right away. I will reimburse you once you send them to this email address.”
- Billing statement: “John, your Verizon billing statement is ready. Please review your charges and send full payment by [date] to avoid late fees.”
If you ever receive a message that appears to be from Firefighters First and are unsure whether it is legitimate, do not click any links. Contact us directly to report any suspicious activity.
How to Stop Spam Texts
Block the sender.
Prevent further messages from that number directly through your phone’s messaging app.
Notify your carrier.
Your carrier can investigate and may be able to block the sender at the network level. Most carriers allow you to forward spam texts to 7726 (SPAM) for reporting.
Use built-in spam filtering tools.
- iPhone: Go to Settings > Messages > Filter Unknown Senders.
- Android: Open Messages > tap the three dots > Details > App Settings > Spam Protection.
Add your number to the Do Not Call Registry.
The FTC’s National Do Not Call list is free to join at donotcall.gov. If you continue receiving unwanted messages after 31 days of registration, you can file an official complaint.
A note on replying “STOP”: Replying STOP is appropriate only for legitimate subscription services you actually signed up for. Never reply to a smishing text in any way, including replying STOP. Responding confirms to scammers that your number is active, which can result in more targeting.
Report and Block
Report smishing attempts to both the FTC at reportfraud.ftc.gov and the FCC at fcc.gov/consumers/guides/filing-informal-complaint. Both agencies have increased enforcement efforts against scam texting and calling and reports from consumers directly contribute to those investigations.
Contact us to report any suspicious activity.
