Wondering, “Is this text message a scam?” Use this reusable smishing checklist to assess bank alerts, delivery notices, government impersonation, account warnings, and fake customer-support messages without clicking, replying, or sharing a one-time code.
Overview
Smishing is phishing delivered by text message. The message may imitate a bank, retailer, delivery company, government service, employer, mobile carrier, or a person you know. Its goal is usually to make you click a link, disclose a password or one-time code, approve a payment, install software, or move a conversation to another channel.
A suspicious message does not become trustworthy because it uses your name, includes a familiar logo, appears in an existing message thread, or comes from a sender ID that looks recognizable. Sender information can be spoofed, and legitimate organizations may also use automated texts. Treat the message as untrusted until you verify it through a separate, known channel.
The safest first response is simple:
- Do not tap the link, call the number, open an attachment, or reply.
- Do not provide a password, payment detail, security answer, or one-time code.
- Verify the claimed issue independently. Open the official app, type the organization’s known website into your browser, or use a phone number from a statement, card, or saved contact.
- Report and block the message using your phone’s built-in tools and the relevant organization’s official reporting channel.
If you already clicked or responded, move quickly but avoid panic. Close the page, change any exposed password from a trusted device, contact the affected provider through an official channel, review account activity, and tell your bank or payment provider about unauthorized transactions. If a work account or device was involved, notify your security or IT team.
Checklist by scenario
Use the following decision process for common text-message scams.
| Message type | Common warning signs | Safe verification step |
|---|---|---|
| Bank or payment alert | Claims of fraud, a locked account, a failed payment, or an urgent request to “verify” details. It may ask for a one-time code or direct you to a login page. | Open the bank’s official app or use the number printed on your card or statement. Do not use the link or phone number in the text. |
| Delivery or missed-package notice | Requests a small redelivery fee, address confirmation, customs payment, or card details. Shortened links and vague tracking references are warning signs. | Check the order in the retailer’s official app or enter the tracking number on the carrier’s website by typing the address yourself. |
| Government or public-service message | Threatens penalties, account suspension, legal action, or loss of a benefit unless you pay immediately or confirm personal information. | Find the agency’s contact details independently. Government-related requests should not be verified through an unsolicited link or caller number. |
| Account or password warning | Uses an urgent security claim and sends you to a login page. The page may closely copy a familiar brand. | Navigate directly to the service’s official website or app. Review security alerts there and change your password only through the trusted route. |
| Fake customer support | Offers help with a refund, purchase, or account problem and asks you to call, install remote-access software, or share a verification code. | Start a new support interaction from the company’s official website or app. Never grant remote access because a text message told you to. |
Apply this quick decision tree: Did you expect the message? If no, treat it as suspicious. Does it demand immediate action? Urgency is a pressure tactic, not proof of fraud. Does it contain a link, payment request, phone number, or code request? Do not use any of those elements until independently verified. Can you confirm the issue in the official app or website? If not, contact the organization using information you already trust.
What to double-check
Look beyond spelling errors. Some scam texts are carefully written, while legitimate automated messages can be awkward or incomplete. Check the entire context instead:
- Sender ID: A familiar name, number, or message thread is not authentication. Compare it with contact details you have verified independently, but do not assume a match proves the message is genuine.
- Link destination: Pressing and holding a link may reveal its destination on some devices, but do not open it. Be cautious of shortened URLs, misspelled domains, extra words, unusual country domains, and addresses that only resemble the real brand.
- Urgency and consequences: “Act now,” “your account will close,” and “avoid arrest” are designed to prevent careful checking. Pause instead of responding under pressure.
- Requested information: A legitimate organization should not need you to disclose a login password or one-time authentication code to a person who contacted you unexpectedly. Never forward a code to “support.”
- Payment method: Requests for gift cards, cryptocurrency, wire transfers, unusual fees, or payment through a link deserve heightened suspicion.
- Conversation history: A new message appearing in a real-looking thread can still be malicious. Judge the request, not the appearance of the thread.
When checking an alleged bank scam text, do not call the number in the message. When checking a delivery text, do not rely on the tracking link it supplies. When checking an account warning, do not sign in from the message. The independent route is the important control.
Common mistakes
- Replying with “STOP” automatically: Some legitimate services support opt-out replies, but replying can also confirm that your number is active. Use your device’s spam-reporting and blocking tools when the message is unsolicited.
- Calling the text’s number to test it: A live person or recorded menu can be part of the scam. Find the organization’s number independently.
- Assuming a small payment is harmless: A minor “verification” charge can expose payment details or lead to follow-up fraud.
- Sharing a one-time code: Treat the code as proof of control over your account. Anyone asking for it unexpectedly may be trying to complete a login or reset.
- Deleting evidence immediately: Save a screenshot, sender details, link text, and approximate time before deleting the message. Do not preserve the link by opening it.
- Only warning yourself: If the message targeted a shared business phone, customer account, or family member, record the pattern and warn others without forwarding the malicious link.
To report a scam text, use your phone’s “report junk” or spam function when available, then block the sender. You can also report the impersonated organization through its official website or app. In some regions and with some carriers, suspicious texts can be forwarded to a carrier spam-reporting service; check your provider’s current instructions rather than relying on an old shortcut. If money, identity information, or an account was compromised, contact the affected financial institution or service promptly and use the appropriate consumer-fraud or identity-theft reporting process for your jurisdiction.
When to revisit
Keep this checklist available because scam campaigns change their wording, impersonated brands, links, and payment demands. Revisit it before seasonal shopping periods, tax or benefits deadlines, travel periods, major account changes, and any time your family or team starts using a new banking, delivery, collaboration, or authentication workflow.
Businesses should review their internal process whenever phone systems, identity providers, payment tools, or employee communication platforms change. Include a rule that staff verify unexpected requests through a separate channel and report suspected account compromise immediately. A short tabletop exercise can help teams practice without clicking a live message; see the Cybersecurity Tabletop Exercise Scenarios workbook for a broader readiness approach.
Before you act on the next suspicious text, save this three-line reminder: Pause. Verify independently. Report without engaging. If the text claims to relate to a breach or account exposure, use a trusted website or app rather than the message itself. For related guidance, read How to Verify a Data Breach Notice and keep a record of any password, payment, or identity-protection steps you take.
