SMS Phishing (Smishing): Fake Delivery and Bank Text Links
Smishing is phishing by text message. A short SMS claims a parcel is held, a bank account is locked or a prize is waiting, and pushes you to tap a link that either steals your login or installs an app you did not mean to have. The messages work because they feel urgent and look routine, which is why it helps to have a few simple rules ready before one arrives.
- Urgency plus a link is the pattern: a deadline, a problem with an account, and a button to fix it.
- Do not tap links in unexpected texts. Go to the company's official app or website yourself instead.
- Some scam texts try to get you to install an APK, which skips the store's checks.
- If you tapped and entered details, change that password straight away and tell the real company.
How smishing works
The US Federal Trade Commission describes the common pattern: a message pretends to be from a business you may know, gives a reason to act quickly, and asks you to click a link or reply with information.[1] Typical stories include:
- A delivery that "could not be completed" and needs a small fee or an address update
- A bank or payment app warning about "unusual activity" or a locked account
- A prize, refund or tax message you were not expecting
- A message from a "family member" with a new number asking for money
Signs a text is not genuine
| Sign | Why it matters |
|---|---|
| Unexpected message | You were not waiting for a parcel or did not contact that company. |
| Pressure to act now | Scammers rely on you not stopping to think. |
| A link that looks slightly off | Shortened links or spelling that mimics a real name hide the true destination. |
| Request for a login, code or card details | Real companies do not ask you to send these by text. |
| A file or app to install | Legitimate firms point you to the official app store, not a file. |
What to do instead
- Do not tap the link or reply. Even replying "STOP" can confirm your number is active.
- Check independently. Open the company's official app, or type its address into your browser yourself, and look for the same notice.
- Never share one-time codes. A code sent to you is for you alone.
- Report it. Most messaging apps and phone companies have a way to report spam or a suspected scam. Check the official site of your carrier or national consumer agency for the current method.
- Block the sender, then delete the message.
If you already tapped or entered details
- Change the password of any account you typed in, and any other account that uses the same one.
- Contact the real bank or company through its official channel.
- If the link downloaded or installed an app, do not open it. Remove it, and run a Play Protect scan.[2] Our guide on sideloading explains why installs outside the store are risky.
Helping children and older relatives
Young people and older relatives are both often targeted, in different ways: a "free game currency" link for a child, a "your account is locked" message for a grandparent. Agree a simple family rule: if a text asks you to click, pay or install, ask a family member first. A calm, no-blame rule makes it more likely they will tell you if they do tap something.
Frequently asked questions
What is smishing?
Smishing is phishing carried out through SMS text messages. The aim is to trick you into clicking a link, installing an app or sharing information.
Can I get a virus just by receiving a scam text?
Receiving the text alone is not normally the risk. The harm comes from tapping a link, installing what it offers, or entering your details on a fake page.
Should I reply STOP to a scam text?
It is safer not to reply at all. Replying can show the sender that your number is active. Block and report instead.
How can I check if a delivery text is real?
Do not use the link. Open the courier's official app or website yourself and track the parcel with your tracking number.
What if a text says it is from my bank?
Contact your bank through the number on your card or its official app, not through details in the message.
- How to Recognize and Report Spam Text Messages — Federal Trade Commission — common scam text patterns and what to do.
- Google Play Protect — Google Play Help — scanning apps on your device for harmful behaviour.