Smishing is phishing by text
The Postal Inspection Service describes smishing as deceptive texting designed to obtain personal or financial information. Messages often imitate a bank, government agency, or delivery service.
A text message is not trustworthy just because it arrives in the same app as conversations with people you know.
Delivery messages are especially common
USPS warns that unsolicited package-tracking messages with unfamiliar links are a common scam. USPS tracking texts require the customer to initiate tracking for a specific package and legitimate USPS text tracking does not send an unsolicited link in the manner described by the scam.
If you expect a package, type the carrier address yourself or use its official app.
Toll and fee messages use urgency
FTC reporting for 2025 showed a large increase in government-imposter reports, including fake overdue toll messages that threaten fees or vehicle-registration consequences.
Do not use the payment link. Contact the state toll authority independently.
Bank texts can imitate real alerts
A message might ask whether you made a transaction and then direct you to a fake login page or scam phone number.
Open the bank’s official app or call the number on the back of your card.
Do not reply to test the sender
Replying can confirm an active number or pull you deeper into the script. Do not send “STOP” to obvious scams unless you know the sender is a legitimate subscription service.
Block and report when appropriate.
If you clicked
Close the page. If you entered a password, change it using the official service and review account activity. If you gave financial information or paid, contact the financial institution immediately.
The next step depends on what information was exposed—not simply whether the link was opened.
Quick Reference
| Text says | Safe response |
|---|---|
| Package needs address/fee | Open official carrier app/site |
| Unpaid toll | Use official state toll site |
| Bank fraud alert | Open official bank app/call card number |
| Account will be closed | Navigate to service independently |
| You won a prize | Do not pay or provide information |
| Family emergency | Call family directly |
Check the Red Flags
Use the Scam Red-Flag Checker to review common warning signs without entering sensitive account information.
Do not use the message link to investigate the message
A fake text may say a package cannot be delivered, a toll is unpaid, a bank account is locked, or a purchase needs confirmation. The link is often the part designed to capture information.
Instead of tapping it, open the company’s official app or type the known website address yourself. If the issue is real, you should usually be able to find it there.
Treat short deadlines as a warning
Texts are effective scam tools because they can create the feeling that you must act before a package is returned, a fee increases, or an account closes.
Pause before responding. A legitimate organization should have another way for you to verify the issue without using the text itself.
Do not reply just to see what happens
Replying can confirm that your phone number is active and can pull you into a conversation where the sender has more opportunities to persuade you.
Use your phone’s block or report-junk controls when available, then delete the message after you have independently confirmed that it is not needed.
If you entered information, act based on what you shared
Entering only a name is different from giving a password, card number, Social Security number, or one-time code. The response should match the information exposed.
Change compromised passwords from a trusted device, contact the card issuer for exposed payment information, and review the affected account directly rather than continuing through the text.
Use time and independent verification as your advantage
The person trying to scam you usually wants speed. Your advantage is that you can stop. You can hang up, close the message, call someone you trust, and verify the claim through an official route you choose yourself.
You do not have to identify the exact scam before protecting yourself. If an unexpected contact wants money, sensitive information, a security code, remote access, or secrecy, stop the interaction and verify before doing anything else.
Use the same verification routine every time
A consistent routine is easier to remember than a different response for every scam. Stop the interaction, identify what the person is asking for, and verify through a contact method you choose. Do not let the caller, text, or email supply the only route back to the organization.
For family emergencies, call the relative or another family member directly. For financial accounts, use the official app, card, or statement. For government or benefit questions, use the agency’s known website or published contact information.
Protect verification codes and remote access
One-time codes, password-reset links, security approvals, and remote-access permissions can give another person a direct path into an account or device. Treat them as highly sensitive even when the person asking sounds professional or urgent.
If you did not start the sign-in or support session yourself, do not approve it. A surprise request for a code or remote-control software is a reason to stop and verify independently.
Do not make payment while someone is pressuring you
Scammers often stay on the phone or in the chat while they tell you exactly how to buy gift cards, move money, use cryptocurrency, or complete a transfer. That constant contact prevents you from getting another opinion.
End the conversation before taking any payment step. A legitimate bill or emergency can be checked through another source, and a genuine organization will still be there after you verify the request.
Review what information may already be public
A caller knowing your name, address, relatives, former employer, or other personal details does not prove that the story is real. Some information is public, commercially available, or exposed in old data breaches.
Use privacy settings on social media where appropriate, but do not rely on secrecy alone. The stronger habit is independent verification whenever an unexpected contact asks for money, account access, or sensitive information.
Sources
Frequently Asked Questions
What is smishing?
Smishing is phishing delivered through text messages.
Should I click a package-tracking link?
Not from an unsolicited suspicious text. Use the carrier’s official site or app.
What is 7726?
7726 spells SPAM and is used by many U.S. carriers for forwarding suspicious text messages.
What if I clicked but entered nothing?
Close the site and monitor for anything unusual. If the page prompted downloads or you installed something, additional device-security steps may be needed.
Should I reply STOP?
Use STOP for legitimate subscriptions. For obvious scams, blocking/reporting without replying is generally safer.
Keep this visual on Pinterest
Save the infographic so you can return to the checklist or comparison when you need it.
Save on Pinterest