That text about a “missed delivery” or a “locked bank account” with a link to tap? There is a good chance it is smishing — phishing by SMS. These scam texts are everywhere because they work, playing on a moment of urgency to make you click before you think. Our GetMyPassword team explains how to spot a phishing text, what to do with one, and how to keep your accounts safe.
What smishing is
Smishing is phishing delivered by text message instead of email. The goal is the same: get you to tap a malicious link, hand over a password or code, or install something harmful. Texts feel personal and urgent, and people tend to trust them more than email — which is exactly why scammers love the channel.
Common smishing texts
- Fake deliveries: “Your package is held — pay a small fee / confirm details here.”
- Bank alerts: “Suspicious charge detected. Verify your account now.”
- Account locks: “Your account will be suspended unless you log in.”
- Prizes and refunds: “You have won / you are owed a refund — claim here.”
The red flags
Watch for urgency and threats, an unexpected link (often a shortened or odd-looking address), a number you do not recognize, and any request for a password, PIN or one-time code. Real banks and delivery firms do not ask you to verify your login by text. When a message pressures you to act immediately, that pressure is the scam.
The link in a scam text is built to look exactly like the real thing. The safe move is never to tap it — open the app or type the website address yourself and check from there.
What to do with a phishing text
Do not tap the link and do not reply — even “STOP” confirms your number is active. Instead, check directly by opening the official app or typing the address yourself. Report the message (many carriers accept forwards to 7726 / “SPAM”), then delete it. If you did tap a link or share a detail, change that account’s password right away with our password generator and turn on two-factor authentication.
Frequently asked questions
What is smishing?
Smishing is phishing carried out by SMS text message. Scammers send urgent texts about deliveries, bank alerts or prizes to trick you into tapping a malicious link or revealing a password, PIN or one-time code.
What should I do if I get a phishing text?
Do not tap the link or reply. Verify directly through the official app or website, report the text to your carrier (often by forwarding to 7726), and delete it. If you interacted with it, change that account’s password and enable 2FA.
Is it dangerous to reply to a spam text?
It can be. Replying, even “STOP,” tells scammers your number is active and may bring more spam. It is safer to report and delete the message without responding.