Smishing is phishing delivered by SMS or messaging apps. A text pretends to be a bank, delivery firm, employer or government agency and pushes you to click a link, call a number or share a code. Do not tap anything. Confirm through an official app or number you already have, then report and delete.
Why does it work so well?
Texts feel personal and urgent, and they arrive on a device people check within minutes. The small screen hides full addresses, and message threads from unknown senders sit beside real ones. CISA notes that phishing now arrives by email, text, direct message on social media and phone calls, and its checklist applies directly: urgent or emotional language, requests for personal or financial information, untrusted shortened links, and links with small errors.
What are the common scripts?
- A parcel could not be delivered, with a link to reschedule and pay a small fee.
- A bank alert about a suspicious transaction, with a number to call or a link to verify.
- A message from a "boss" asking for gift cards or a quick favor.
- A toll or fine notice demanding immediate payment.
- A multi factor code request: "we sent you a code by mistake, please read it back".
The last one is especially important. If someone asks you to read out a one time code, they are almost certainly logging in as you at that moment.
Constructed example: the delivery fee
A user receives a text: a package is held, and a fee of a couple of dollars is needed to release it. The sender is an unfamiliar number. The link is a short address. The user taps, lands on a polished page that looks like a courier site, and enters card details to pay the small fee.
The card data is now with the scammer, who tries a larger purchase within minutes, and often the page then asks for the code your bank just texted. The small amount is bait. The real goal is the card number and the one time code.
What should have given it away: an unexpected message from an unknown number, a link that does not use a domain the courier has told you about, and a payment request through a link. The safe path is to open the courier's official app or type its address yourself and enter your tracking number there.
What should you do with a suspicious text?
Do not respond to texts from unknown or questionable sources, and never click links in them, as the FCC advises. Take a screenshot if you need to show someone. Most mobile carriers let you report spam by forwarding the message to 7726 (SPAM), though you should check with your provider. Block the sender and delete the message.
If you did click and enter details, contact your bank at once using the number on your card, change the password for any account you used, and watch for unusual activity. If you shared a one time code, assume that account is compromised and reset it.
How can organizations reduce the risk?
Phishing resistant authentication, such as passkeys or hardware security keys, makes stolen codes less useful because the credential is tied to the real site. Staff training should include texts and calls, not only email. Keep a published rule on how the company will contact employees, for example "we never ask for passwords or codes by text". And give people a single place to report, which makes the response faster.
How to check or apply this
- Treat any unexpected text with a link or payment request as suspicious.
- Open the official app or type the known website address yourself.
- Never share a one time code with anyone who contacts you.
- Report by forwarding to 7726 if your carrier supports it, or use the app's report option, then block and delete.
- Use passkeys or security keys where available, since they resist code harvesting.
- If you entered details, call the bank on the number printed on your card and reset affected passwords.
- Tell your workplace if the text targeted a company account.
Quick check
Should I reply to a text from a number I do not know?
No. The FCC advises not responding to texts from unknown or questionable sources and not clicking links in them. Report, block and delete instead.
Why do scammers ask for the code they just sent me?
They are signing in to your account and need the one time code to pass multi factor authentication. Never read it to anyone.
Sources
- CISA, Recognize and Report Phishing
- CISA, Avoiding Social Engineering and Phishing Attacks
- FCC, Stop Unwanted Robocalls and Texts
- FBI Internet Crime Complaint Center
Last reviewed: 18 October 2026.
