How to Spot a Phishing Text Message Before You Tap

Your package couldn’t be delivered. Your bank account has been locked. You have an unpaid toll. Your streaming subscription failed to renew. Someone has logged into your account from another country. Just tap this link to fix it.

Text messages like these arrive on millions of phones every day, and they work far more often than anyone would like. They’re called phishing texts, or smishing, a mix of SMS and phishing. The goal is always the same: get you to tap a link, enter your passwords or card details on a fake website, share a verification code or call a fake support number.

The good news is that phishing texts follow recognizable patterns. Once you know what to look for, most of them become surprisingly easy to spot. In this guide, we’ll walk through the warning signs, real-world examples of common scams, what to do if you receive one and what to do if you’ve already tapped a link or shared information.

Nobody is too smart to be fooled. Scam messages are designed by people who do this full time and test which wording works best. The goal of this guide is not to make you suspicious of every message, but to give you a few simple habits that catch the vast majority of scams before they can do any harm.

Why phishing texts are so effective

Phishing by text message works because of how we use our phones. We read texts quickly, often while doing something else. Phone screens show less information than a computer, so it’s harder to inspect links. And text messages feel personal and urgent in a way that email often doesn’t.

Scammers also take advantage of real life. Everyone is waiting for a package at some point. Most people have a bank account, a streaming subscription and a mobile carrier. By sending messages about these everyday things to huge numbers of people, scammers know that some recipients will be expecting exactly that kind of message on exactly that day.

Finally, these messages are designed to make you act before you think. They create urgency, fear or excitement, because emotions make people less careful.

Another reason these scams succeed is volume. A scammer can send hundreds of thousands of messages for very little money. Even if only a tiny fraction of people respond, it is profitable. That is also why you should never feel embarrassed for receiving these messages. Your number is not special. It is simply on a list.

The most common types of phishing texts

Recognizing the common scenarios makes it easier to spot new variations.

Delivery problems

Your package is on hold, the address is incomplete or a delivery fee is due. These messages often include a link to a fake delivery website that asks for your card details to pay a small fee. Real delivery companies rarely ask for payment by text link.

Bank and payment alerts

Your account is suspended, a suspicious payment was made or you need to verify your identity. The link leads to a convincing copy of your bank’s login page. Sometimes the message asks you to call a number, where a fake fraud team asks for your codes.

Unpaid tolls, fines and taxes

These messages claim you owe money for a toll road, a parking ticket, a traffic fine or a tax refund, and they threaten penalties if you don’t pay quickly.

Account security warnings

Someone tried to log into your account, your password expires today or your account will be deleted. These often imitate big tech companies, email providers and social networks.

Prizes, refunds and too-good-to-be-true offers

You’ve won a gift card, you’re owed a refund or you’ve been selected for a special offer. All you need to do is enter your details or pay a small processing fee.

Hi Mum, Hi Dad and wrong-number texts

A message from an unknown number claims to be your child who lost their phone and needs money urgently. Or a friendly wrong-number text starts a conversation that slowly leads to an investment scam or a request for money.

Job offers

Unsolicited messages offering easy, well-paid remote work often lead to scams where victims are asked to pay upfront or move money on behalf of others.

New variations appear all the time, often tied to current events, holidays or seasonal activities like tax season, holiday shopping or travel periods. The details change, but the structure stays the same: an unexpected problem, a reason to act fast and a link or number to fix it.

Ten warning signs of a phishing text

No single sign proves a message is a scam, but the more signs you see, the more suspicious you should be.

1. Urgency or threats. Act now, final notice, your account will be closed today.
2. Unexpected messages. You weren’t expecting a refund, a prize or a fine.
3. Requests for personal information. Passwords, PINs, card numbers or verification codes.
4. Strange links. The web address doesn’t match the company’s real website, uses odd spellings, extra words or unusual domain endings.
5. Shortened links that hide the real destination.
6. Generic greetings. Dear customer instead of your name, although some scams do use names.
7. Spelling and grammar mistakes, though many scams are now well written.
8. Unknown or strange sender numbers, including international numbers or email addresses sending texts.
9. Requests to pay in unusual ways, like gift cards, cryptocurrency or wire transfers.
10. Pressure to keep it secret or not to contact anyone else.

A good rule: legitimate organizations rarely ask you to click a link in a text to fix a problem with your account or payment. When in doubt, assume it’s a scam until you’ve verified it yourself.

A helpful habit is the pause and verify rule. Whenever a text asks you to do something involving money, passwords or personal details, pause for a minute. Then verify it through a channel you trust, like the official app, the website you type in yourself or a phone number from your card. That single minute defeats most scams.

How to check a link safely

The safest approach is simple: don’t tap links in unexpected texts. Instead, go directly to the company’s website or app the way you normally would.

If you’re curious about a link:

• On some phones, long-pressing a link shows a preview of the address without opening it. Look closely at the domain, the part right before the first single slash.
• Watch for lookalikes: extra letters, swapped characters, extra words or unusual endings. A real company domain may be cleverly imitated.
• Remember that a padlock icon only means the connection is encrypted. Scam sites can have padlocks too.

Even if a link looks legitimate, it’s still safer to open the official app or type the website address yourself.

When in doubt, a quick search can also help. Type a short phrase from the message into a search engine along with the word scam. Popular scam campaigns are often reported widely, and you may find warnings from the real company or from consumer protection agencies describing exactly the message you received.

Be especially careful with links that arrive through messaging apps other than SMS, such as WhatsApp, Telegram or social media direct messages. The same tricks apply there, and scammers increasingly use these apps because they feel even more personal and informal than text messages.

What to do when you receive a phishing text

1. Don’t tap the link and don’t reply, not even to say stop. Replying confirms your number is active.
2. Don’t call numbers in the message. If you’re worried, call the number on the back of your card or on the company’s official website.
3. Verify independently. Open the official app or website to check for any real issues with your account or delivery.
4. Report it. In the United States, the United Kingdom and several other countries, you can forward spam texts to 7726, which spells SPAM on a keypad, to report them to your carrier. Check what your carrier supports in your country.
5. Use your phone’s reporting tools. Both Android and iPhone let you report and block senders from the message thread.
6. Delete the message.

Built-in protections

On Android, Google Messages includes spam protection that can automatically flag suspected spam. Make sure it’s turned on in Messages settings under Spam protection.

On iPhone, go to Settings, then Apps, then Messages, and turn on Filter Unknown Senders. Messages from people not in your contacts go to a separate list, making suspicious texts easier to ignore. You can also report junk directly from the message.

It also helps to keep your real contacts saved properly. When your bank, your carrier and your delivery companies are saved with their official numbers, a message from a random number pretending to be them stands out more clearly. Some genuine organizations also send messages from short codes, which you can verify on their official websites.

What to do if you already tapped the link or shared information

It happens to smart, careful people. Scammers are skilled. If you’ve tapped a link or entered information, act quickly and calmly.

If you only opened the link

If you tapped the link but didn’t enter anything, the risk is usually low. Close the page, don’t enter any information and clear your browser history and website data. Keep your phone updated.

If you entered a password

Change that password immediately on the real website or app, and anywhere else you use the same password. Turn on two-factor authentication if you haven’t already. Check your account for unfamiliar activity, such as changed settings, new devices or forwarding rules in your email.

If you entered card or banking details

Contact your bank immediately using the number on your card or in the official app. Ask them to block the card and monitor for fraud. Review recent transactions and report anything you don’t recognize.

If you shared a verification code

Contact the service right away. A shared code may have given someone access to your account. Change your password, sign out other sessions and review security settings.

If you installed an app

If a message led you to install an app, uninstall it, run a security scan with Google Play Protect on Android and consider contacting your bank if the app had access to financial information.

Report it officially

Depending on your country, report fraud to your bank, your mobile carrier and the relevant consumer protection or police reporting service. Reporting helps authorities track and stop scam campaigns.

Above all, do not let embarrassment stop you from acting. Banks and service providers deal with these situations every day and would much rather hear from you quickly. The sooner you report a problem, the more they can do to stop fraudulent transactions and protect your account.

Protect your family

Scams often target older relatives and young people who are new to managing accounts. Share what you’ve learned:

• Agree on a family rule: no one ever shares verification codes or sends money based on a text alone.
• Set up a family code word for real emergencies, so a Hi Mum scam can be quickly identified.
• Help relatives turn on spam filtering and unknown sender filtering.
• Encourage everyone to ask before acting on any message that feels urgent.

Older relatives often worry about being a burden when they are unsure about a message. Let them know that you would much rather get a quick call asking is this real than deal with the aftermath of a scam. Making it easy and normal to ask is one of the most effective protections a family can have.

Young people are targeted too, especially with fake job offers, online shopping deals and social media giveaways. Talk with teenagers about the same warning signs. They are often confident with technology but less experienced with how scammers use pressure and too-good-to-be-true promises.

Frequently asked questions

Can I get hacked just by opening a text message?

For most people, simply receiving or opening a text is not dangerous. The risk comes from tapping links, entering information, calling numbers or installing apps. Keep your phone updated for the best protection.

Why do I get so many scam texts?

Scammers send messages to huge lists of numbers, some generated automatically and some from data leaks. Receiving scam texts doesn’t necessarily mean you did anything wrong.

How do scammers know which bank or delivery company I use?

Often, they don’t. They send messages about popular companies to many people, knowing some recipients will be customers.

Should I reply STOP to scam texts?

No. Replying confirms your number is active. Report and block instead. Only reply STOP to legitimate marketing messages from companies you know.

Is it safe to tap a link if it starts with https?

No. HTTPS only means the connection is encrypted. Scam websites can use HTTPS too. Check the domain and, better yet, go directly to the official app or website.

What if the message includes my real name?

Scammers sometimes have names from data leaks. A message using your name isn’t proof that it’s legitimate.

Final thoughts

Phishing texts rely on surprise, urgency and quick reactions. The best defense is a calm habit: don’t tap links in unexpected messages, verify problems through official apps or websites, never share codes and report scam texts. If you do slip up, act quickly by changing passwords and contacting your bank. A few seconds of skepticism can save you a lot of money and stress.

The more you practice spotting these messages, the faster and more automatic it becomes. After a while, you will recognize a phishing text within a couple of seconds, often from the first sentence. That instinct is one of the most valuable digital safety skills you can build.