How to Spot a Phishing Text Message

You get a text: your bank account has been locked, a package is waiting, or you've won something you never entered. These "smishing" messages — phishing sent by SMS — are one of the most common scams in the world, precisely because almost everyone reads their texts.

The good news: fake texts follow patterns. Once you know them, most phishing messages become easy to spot. Here's what to look for.

1. It comes from an unknown or odd-looking sender

Legitimate companies usually text from a consistent short code or a verified sender name. Scam texts often arrive from random 10-digit mobile numbers, email addresses, or slightly misspelled brand names like "ChaseBnk" instead of "Chase". A real bank will never text you from a personal-looking number.

2. It creates urgency or fear

"Your account will be closed in 24 hours." "Suspicious activity detected — verify now." Urgency is the scammer's favorite tool: it pushes you to act before you think. Real companies rarely demand instant action by text.

3. It contains a link you didn't ask for

Hovering (or long-pressing) a link reveals where it really goes. Scam links use lookalike domains — extra words, hyphens, or odd endings like .top, .xyz, or .info instead of the company's real domain.

4. It asks for personal information or payment

Banks, delivery companies, and government agencies do not ask for passwords, card numbers, or Social Security numbers over text. Any message asking you to "confirm" such details is a red flag on its own.

5. The deal is too good to be true

Prize winnings, surprise refunds, crypto giveaways — if you didn't enter, you didn't win. These lures exist only to get you to click and hand over details.

What to do instead of tapping

• Don't click the link and don't reply. Replying — even with "STOP" — confirms your number is active.
• Verify through the official channel. Open the company's real app or website yourself; never use the link in the message.
• Check the message with a second opinion. Paste the text into a scam checker to get a quick risk read.
• Report it. Forward spam texts to 7726 (SPAM) in the US, then delete the message.

← Back to all articles