What Is Smishing?

"Smishing" is phishing by SMS — scam text messages designed to trick you into clicking a link, calling a number, or replying with personal information. The name comes from combining "SMS" and "phishing."

Text scams are growing faster than email scams because people tend to trust text messages more. We're used to getting legitimate texts from our bank, delivery services, and government agencies. And unlike emails, texts feel personal and urgent — most people read a text within 3 minutes of receiving it.

People open 98% of text messages but only 20% of emails. That's exactly why scammers are shifting to SMS — the odds of you reading their message are nearly guaranteed.

Why Text Scams Are Harder to Spot

Text messages have some built-in disadvantages for detecting scams:

Some scam texts appear in the same conversation thread as real messages from your bank. This happens because the sender name is spoofed. Don't trust a text just because it's in a thread with legitimate messages.

  1. Short format: There's less content to analyse, so fewer clues to spot.
  2. No sender address: Unlike email, you can't check a domain. You just see a phone number or a sender name.
  3. Harder to inspect links: On a phone, you can't easily hover over a link to preview where it goes.
  4. Sender names can be spoofed: Many legitimate companies send texts from a "short code" or sender name like "RoyalMail." Scammers can spoof these.
  5. They arrive in the same inbox: A scam text might appear in the same thread as real messages from your bank if the scammer spoofs the sender name.

The Most Common Text Scams

These are the text scams you're most likely to encounter:

  1. Delivery scams: "Your package is waiting — pay the £1.45 customs fee to release it: [link]"
  2. Bank alerts: "We've detected unusual activity. Verify your identity: [link]" or "Your account has been frozen."
  3. Tax refunds: "HMRC/IRS: You are due a refund of £347.82. Claim here: [link]"
  4. Toll/parking fines: "You have an unpaid toll of $4.15. Pay now to avoid penalties: [link]"
  5. Family emergency: "Mum, I've lost my phone. This is my new number. Can you send me money for [urgent reason]?"
Real-world example

Real case: The "Hi Mum" scam

In 2022-2023, millions of people received texts saying "Hi mum, I've broken my phone, this is my new number." The scammer then builds a conversation and eventually asks for money to pay a bill, cover an emergency, or fix the broken phone. In Australia alone, this scam cost victims over $7.2 million in one year.

How to Check a Suspicious Text

Follow these steps when you receive a text that asks you to do something:

  1. Don't click any links. If you need to check something, open your browser and go to the company's website directly.
  2. Check with the real source. Expecting a package? Track it on the delivery company's app using your tracking number. Got a bank alert? Log in through the banking app.
  3. Search the phone number online. Many scam numbers are reported and listed on scam-tracking websites.
  4. If it claims to be from family, call them on their known number to verify.
  5. Forward the text to your country's scam reporting number (7726/SPAM in the US and UK).

What If You Already Clicked?

If you've already tapped a link in a scam text:

  1. Don't enter any information on the page that opens. Close the browser immediately.
  2. If you did enter information, change those passwords immediately from a different device.
  3. If you entered payment details, contact your bank immediately to block the card.
  4. Run a security scan on your phone.
  5. Monitor your accounts for unusual activity over the next few weeks.