Not sure whether a text message is legitimate? This reusable smishing checklist helps you pause, inspect the message safely, verify the request through an independent channel, and report or contain it without clicking a suspicious link.
Overview
Smishing is phishing delivered by text message. The sender may pretend to be a bank, delivery company, toll service, employer, government office, mobile carrier, or someone you know. The goal is usually to make you click a link, disclose a password or one-time code, install software, send money, or call a fraudulent number.
A message can be a scam even when it uses your name, references a real company, or arrives in the same conversation thread as legitimate alerts. Caller ID and sender information can be spoofed, and criminals often copy familiar branding. Treat unexpected texts as untrusted until you verify them independently.
Quick decision tree:
- Were you expecting this exact message? If no, continue cautiously. If yes, still verify before using its link or phone number.
- Does it create urgency, fear, or a reward? Requests to avoid account closure, pay a fee immediately, claim a refund, or confirm a prize are warning signs.
- Does it ask for a password, payment, security code, or personal details? Do not provide them by replying to the text.
- Does it contain a link or unfamiliar phone number? Do not tap it. Open the official app or type the known website address yourself.
- Can the request be confirmed independently? Contact the organization using information from a statement, official app, saved contact, or known website. If it cannot be verified, delete and report the message.
Checklist by scenario
Bank, card, or payment alert
A bank scam text may claim that a transaction is suspicious, your account is locked, or a payment needs approval. Do not reply with a one-time code, card number, PIN, password, or identity details. Do not call the number in the message. Instead, open the bank's official app by using your normal device shortcut or type the bank's known web address manually. Review recent activity and contact support through the channel listed there. If you already disclosed information, contact the bank immediately through its official channel and ask what accounts or credentials need protection.
Package, toll, or delivery notice
Unexpected delivery-fee and toll-payment texts commonly use a short deadline and a link to a convincing payment page. Check your order directly in the retailer or carrier app. For a delivery you did not order, do not use the message's tracking link. Compare the tracking details with the order record you already have. Keep a record of the message if you need to report it. For more examples, see Package Delivery Scam Alerts.
Account, password, or security warning
A message may say that an email, social, cloud, or streaming account will be closed unless you sign in. Check the account by opening its official app or entering the address yourself. Review security notifications inside the account rather than trusting the text. If you clicked and entered a password, change it from a clean, trusted route and change it anywhere else that used the same password. Turn on multifactor authentication where available.
One-time code or “wrong number” conversation
Never forward a one-time code because someone claims it was sent to you by mistake. A code can help another person access an account or reset a credential. “Wrong number” conversations can also be a gradual social-engineering tactic: the sender begins casually, builds trust, and later asks for money, investment, identity information, or a favor. Stop responding when the conversation becomes unusual or transactional.
Work-related request
A text that appears to come from an executive, coworker, supplier, or customer may request gift cards, a wire transfer, a password, or an urgent change to payment details. Verify through a separate channel and follow your organization's approval process. Do not use the phone number or link supplied in the text. Businesses can pair this personal checklist with a business security incident response checklist if an employee has already interacted with the message.
What to double-check
- Sender identity: A familiar display name is not proof of authenticity. Look for the full number or sender details, but remember that those can also be manipulated.
- Link destination: Do not tap a suspicious link to inspect it. Shortened links, misspellings, extra words, unusual domains, and requests to download an app deserve caution.
- Message context: Ask whether you actually have an account, order, appointment, or unpaid balance with the named organization. A generic message can be sent to many numbers at once.
- Payment method: Requests for cryptocurrency, gift cards, wire transfers, unusual payment portals, or immediate transfers are strong reasons to stop and verify.
- Timing and pressure: Legitimate issues can usually be checked through the organization's normal account or support process. Pressure to act before you can verify is itself a warning sign.
- Account activity: If you clicked, entered credentials, downloaded an attachment, or approved a login, check the affected account from a trusted device. Sign out other sessions, review recovery settings, and monitor financial activity as appropriate.
When reporting a scam text, use your phone's built-in option to report junk or spam when available, then block the sender. Reporting routes vary by carrier, device, country, and organization, so check the current instructions in your carrier's support materials or the relevant official service. Preserve screenshots and the sender details if money, credentials, or identity information were involved.
Common mistakes
Searching for the phone number and trusting the first result: Search results can include unreliable pages or advertisements. Start with a known official website or app instead.
Replying “STOP” to an unfamiliar sender: Some legitimate services support this, but replying can confirm that your number is active. Use the device's blocking and reporting controls when the message is suspicious.
Calling the number in the text: A scammer may answer a call and continue the pretext. Find the contact number independently.
Assuming a small amount is safe: A low-fee request can be used to capture payment details or begin a longer scam. Verify every unexpected payment request.
Deleting evidence immediately: If you lost money or shared information, save the message, links, screenshots, receipts, and timeline before deleting it. This record can help your bank, employer, carrier, or reporting service understand what happened.
Only changing the exposed password: If the same password was reused, update each affected account and review multifactor authentication, recovery email addresses, forwarding rules, and active sessions.
When to revisit
Return to this checklist whenever a text asks you to act urgently, sign in, make a payment, share a code, or install something. Revisit it before seasonal periods that bring more delivery, travel, tax, shopping, or account-renewal messages, since familiar themes can make fraudulent texts seem plausible.
Editors should review carrier reporting links, device-specific blocking steps, and common scam themes at least quarterly or whenever major messaging workflows change. Businesses should update internal verification contacts and payment-approval rules whenever staff, vendors, banks, or communication tools change.
If you clicked a link or shared information, act now: stop communicating with the sender, contact the affected organization through an independently verified channel, secure exposed accounts, monitor for follow-up fraud, and report the incident through appropriate official routes. For a broader recovery process after personal exposure, use the Personal Data Breach Recovery Tracker.
