How to spot a scam text message: the signs of smishing and what to do
Parcels on hold, blocked accounts, fines to pay: scam texts are getting more convincing. Here are the five signs that give them away, and what to do if you've already tapped the link.
- Level
- beginner
- Time
- 5 minutes
- What you need
- Nothing, just curiosity
Smishing is phishing by text message, a message pretending to come from a courier, your bank, the tax office or a government agency, pushing you to tap a link to “unlock” something. The wording is more and more polished, and sometimes the sender turns up inside the same thread as the genuine messages, thanks to a technique called spoofing. So it pays to learn to recognise them from what they say.
Phishing (from "fishing": the scammer casts a line and waits): a fake message imitating a genuine sender to make you hand over data or money. Smishing: the same trick by SMS. Spoofing: the technique that makes a scammer's text appear inside the thread of genuine messages from your bank. OTP (one-time password): the six-digit code sent to confirm a sign-in or a payment.
The five signs
Urgency. “Your account will be blocked within 24 hours”, “Your parcel will be returned to sender today”. The rush is there to stop you thinking. No bank and no courier closes an account or sends a parcel back because of an unread text.
A strange link. Banks don’t send links by text for security operations. If the link carries the service’s name but sits on an odd domain, say “royal-mail-verify.xyz”, or on a shortener like bit.ly, it’s a scam.
A request for data or payment. A courier doesn’t ask for 1.99 to “clear customs” by text. A bank never asks for PINs, one-time codes or passwords.
Odd wording and mistakes. They aren’t always there, but a phrase like “Dear customer you parcel is waiting” is a strong clue.
And then the simplest one of all: you weren’t expecting anything. If you haven’t ordered anything and don’t bank with that bank, delete the message and move on.
What to do if you tapped the link
If you only opened the link and closed the page, in the great majority of cases nothing happened, because opening a web page, on its own, is rarely enough to infect an up-to-date phone. The risk rises if the phone is behind on updates, or if after opening the page you installed something or granted a permission.
If you did enter data, don’t wait. Change the password of the service involved, call the bank to block cards and account, and turn on two-factor authentication. If you installed an app from a link (it happens on Android), uninstall it and watch your bank statements over the following days.
How to report it
Forward the message to your carrier’s spam-reporting number where one exists (7726 in the UK, US and several other countries) and report it to your national consumer or cybercrime agency. Blocking the number helps little, since it changes every time, but reporting does help get scam sites taken down faster.