What Is Smishing? Meaning, Signs and What to Do

Smishing is phishing by text message: a fake text, often posing as a bank, delivery company or government agency, that tries to get you to tap a link, share personal details or pay. Merriam-Webster defines it as sending texts to trick someone into revealing personal or confidential information for criminal use. The word blends SMS and phishing.

The same messages arrive on WhatsApp and other apps, the UK's Report Fraud service notes, and the aim is a fake website that steals your data and money or infects your device.

How smishing shows up

Report Fraud and Australia's Scamwatch list signs like these:

A parcel, prize or service you never ordered.
An urgent security alert, such as a locked bank account.
A delivery fee to pay before your parcel arrives.
A family member asking you to send money.
A link you're pushed to tap, or a web address that's slightly off.
A request for card numbers, passwords or one-time codes.
No use of your name, or a message sent late at night or very early.

Don't trust the sender's name: Report Fraud warns that a spoofed number can drop a fake text into the same thread as real messages from your bank. In the US, the Postal Inspection Service says USPS only texts you if you asked for updates, and never with a link.

An example of smishing

This is an invented example.

"Your parcel is on hold due to an unpaid shipping fee of $1.99. Pay within 24 hours or it will be returned to the sender: [link]"

The small fee is bait; the real target is your card details.

Smishing vs. phishing

Phishing is the broader term. Merriam-Webster defines it as tricking internet users into revealing personal or confidential information, for example through deceptive emails or websites. Smishing is the text message version.

What to do about a smishing text

Don't tap the link, reply or pay. Break contact, as Report Fraud advises.
Check another way. Use the official app, or call a number you know is correct.
Report it. In the US and the UK, forward the text to 7726 (it's free, and most UK providers take part, says the NCSC). In the US, also use ReportFraud.ftc.gov, as the FTC suggests. In Australia, report to Scamwatch.
If you entered card details or paid, call your bank or card provider now. In England, Wales and Northern Ireland, report the loss to Report Fraud or on 0300 123 2040; in Scotland, call Police Scotland on 101. In the US, the FBI also takes reports at ic3.gov.
If you entered a password, change it and turn on two-factor authentication, as the FTC advises. If you shared your Social Security number, the FTC points you to IdentityTheft.gov.

Mirabu's Scam Detector reads a screenshot of a message for common scam scripts, suspicious-looking links, payment requests and pressure phrases, as a signal rather than proof. It never opens links. A friendly "hi, how are you?" from a stranger can be the start of a crypto investment scam like pig butchering, the FTC warns. More in our guide to scam texts.

Sources

Smishing and Phishing, Merriam-Webster
Smishing, Report Fraud (City of London Police)
Phishing scams and Report a scam, Scamwatch (ACCC)
Smishing, US Postal Inspection Service
Report a scam text message, National Cyber Security Centre
How to recognize and report spam text messages, What to do if you were scammed and Why it's not rude to ignore "hi, how are you?" texts, FTC