Phishing Text Messages: Examples, Red Flags and What to Do

Yes, phishing happens by text. The FBI calls scams sent by SMS smishing, and the goal is always the same: get you to tap a link, call a number, or reply with money or personal details. This guide shows you the most common phishing texts, the warning signs that give them away, and what to do in the first five minutes if you already tapped or replied.

TL;DR

• A phishing text pretends to be a bank, delivery service, toll agency, or employer and pushes you to act fast.
• Do not tap the link, reply, or call the number in the text. Not even to text “STOP.”
• To check a message, go to the organization’s real website or use a phone number from a bill or card.
• Forward the text to 7726 (SPAM), report it at ReportFraud.ftc.gov, then delete it.
• If you shared a Social Security, card, or bank number, go to IdentityTheft.gov right away.

Table of Contents

• What a phishing text message is
• Phishing text examples you are likely to see
• Quick reference: message, trick, and what to do instead
• Warning signs that a text is phishing
• What to do when a suspicious text arrives
• If you already tapped, replied, or shared information
• Where we see people get caught
• Our perspective
• Make your family harder to scam
• Reduce how many phishing texts you get
• FAQ
• Sources

What a phishing text message is

Phishing is a message built to trick you into handing over information or money. When it arrives by text, it is called smishing, a mash-up of SMS and phishing. The text looks like it came from someone you trust. It usually includes a link or a phone number.

The FCC says a typical smishing text may appear to come from a bank. Scammers can use what you give them to manipulate your personal information, sell it, use it in other scams, or install malware on your phone.

Texts work well for scammers because they are short, personal, and easy to act on from a phone. You see the message on a small screen, the link is one tap away, and the sender’s details are hard to inspect.

Phishing text examples you are likely to see

The FTC’s review of top text scams of 2024 lists the main types: fake package-delivery texts, task-job offers, fraud alerts, unpaid-toll notices, and wrong-number approaches. Here is what each looks like and why it works.

Fake package-delivery texts

This is the most reported text scam. In 2024, the FTC says, fake delivery problems topped the list, and many people reported paying a small redelivery fee that was really a trick to get a credit card or Social Security number.

A typical message says your package could not be delivered and you need to confirm your address or pay a fee. The FTC notes that USPS will not unexpectedly contact you about a delivery unless you started a request and gave a tracking number. USPS also will not demand payment to redeliver a package.

We break this one down in more detail in our guide to package delivery text scams.

Bank and fraud alert texts

The FTC says phishing texts commonly pretend to be a bank, credit-card company, utility, payment app, or another trusted name. They claim there is suspicious activity or an account problem, or ask you to confirm personal or financial information.

A made-up example: “Your debit card was used for a $412 purchase. If this was not you, call us now to cancel.” The number belongs to the scammer. The person who answers sounds professional and asks you to “verify” your card number or move money to a “safe account.”

The reason this scam works is panic. You are afraid of losing money, so you act before you think. Knowing the kinds of alerts your card issuer really sends helps a lot. This overview of credit card fraud alert types explains what genuine alerts look like, so a fake one stands out.

Unpaid toll notices

These texts say you owe a small toll balance and threaten a late fee or a problem with your vehicle registration. They often name a toll system and include a link to “pay now.” Real toll agencies bill you through their own accounts and websites. If you are unsure, open the agency’s site by typing the address yourself, or use the number printed on your toll account paperwork or statement.

Wrong-number texts

A text arrives that reads like it was meant for someone else: “Hi, are we still on for dinner Friday?” Reply to correct them and a friendly conversation begins. Over days or weeks it can turn into a romance, a friendship, or an investment tip. This is a slow phishing approach. We cover where it ends up in wrong-number texts that lead to fake trading apps and in our online romance scams video guide.

Job offers by text

A stranger texts about a flexible remote job paying well for simple tasks like liking videos or rating products. Early “payments” may even arrive, until you are asked to deposit your own money to unlock more earnings. See our guide to spotting a fake job offer before you pay anything.

Prizes, gift cards, and surveys

The FTC warns that unexpected texts using names like Costco or Home Depot may offer a package, survey, prize, gift card, or tool. They are designed to get your money or personal information. If you did not enter a contest, you did not win one.

Government and refund texts

The FTC says these messages may tell a story, such as an invoice, payment link, government refund, or free coupon. Real agencies do not start with a surprise text asking for payment or personal details. If a text claims to be the IRS, read our IRS imposter scams video guide.

Quick reference: message, trick, and what to do instead

Warning signs that a text is phishing

No single sign proves a text is fake. Several together usually do. These come from federal guidance.

• It is unexpected. You did not order anything, enter anything, or ask for contact.
• It creates urgency or fear. CISA lists urgent or emotionally charged language as a common phishing sign.
• It asks for personal or financial information. Banks and agencies do not collect your full card number, PIN, or Social Security number by text.
• It has a link you cannot verify. CISA flags untrusted shortened URLs and links that do not match the organization they claim to come from.
• It asks you to call, reply, or pay. Anything that moves you into a conversation or a payment is a red flag.
• It arrives at an odd hour. The UK government’s Stop! Think Fraud guidance lists unusual sending times among its signs. It is a UK source, but the pattern applies here too.

Do not rely on typos

Many people look for spelling mistakes. That is no longer a safe test. CISA cautions that perfect grammar and spelling are no longer evidence that a message is legitimate. Judge the request, not the polish.

Want to test yourself? Try our free Spot the Fake scam quiz or the two-minute scam self-check if you have a message in front of you.

What to do when a suspicious text arrives

Do these in order.

1. Stop. Do not tap the link. Do not call the number. Do not reply.
2. Do not text “STOP.” The FCC advises not responding, even if the message tells you to text STOP, because a reply confirms your number is active.
3. Check it a different way. Look at a bill, a card, or the organization’s official website for contact information. Then call or email separately to ask whether the text was real. Type the website address yourself.
4. Report it. Forward the text to 7726 (SPAM) and report it at ReportFraud.ftc.gov. The FCC also takes a no-cost complaint through its Complaint Center.
5. Block and delete. Block the number, then delete the message.

Texts from an email address

Some phishing texts show an email address instead of a phone number. That is common with messages sent through email-to-text gateways. Treat it exactly like an unknown number: do not tap, reply, or call. A real bank or carrier will not start a sensitive conversation from a random email address.

Unknown numbers and blocking

Blocking helps with nuisance texts, but scammers switch numbers often. Blocking is cleanup, not protection. The protection is your habit of never acting on the text itself. Your phone’s settings and your carrier’s spam tools can filter more, and reporting to 7726 feeds those filters.

If you already tapped, replied, or shared information

It happens to careful people. Move quickly and calmly.

If you only tapped the link

Close the page and do not enter anything. Update your phone’s operating system and security apps, and run a scan. The FTC says if a link or attachment downloaded harmful software, update your security software, run a scan, and remove anything it identifies.

If you entered a password

Change that password right now on the real site, and anywhere else you used it. Turn on multi-factor authentication for sensitive accounts. The FCC recommends multi-factor authentication for sensitive information.

If you gave a Social Security, card, or bank number

The FTC says to go to IdentityTheft.gov if you think a scammer has your Social Security, credit card, or bank account number. It gives you a recovery plan. Call your bank or card issuer using the number on your card, and tell them what happened. The FCC also says to contact law enforcement if you believe you were a victim of smishing.

If you paid or sent money, or think your phone number is being hijacked, our Get Help Now page walks you through next steps. Our guide to SIM swap scams explains how to keep someone from taking over your number. For a fuller walkthrough of the aftermath, read what to do if you tapped the link.

Where we see people get caught

We hear the same stories again and again. Most are not about carelessness. They are about timing.

• You are expecting a package, so a delivery text feels normal.
• You just used a toll road, so a toll text seems plausible.
• You are busy, tired, or worried about money.
• The message looks like it came in the same thread as a real one.

The fix is a rule, not willpower. Decide ahead of time: I never act on a text. I go to the source myself. Then it does not matter how good the message looks.

Our perspective

We write for people who are not tech experts, and we think the usual advice sets readers up to fail. “Look for typos” and “check the sender” are tests that require you to be calm and observant at the exact moment a scammer is trying to rattle you. Scammers know that.

So we teach one habit. Treat every unexpected text as unverified, whatever it says and however real it looks. Go to the organization’s real site or a number on your card. That habit works for delivery texts, bank alerts, toll notices, and whatever scammers invent next.

We also think families should talk about this before it happens. Parents, teens, and grandparents are all targeted, with different stories. Agree on a plan: nobody gets in trouble for tapping, and everybody says so quickly. Speed is what limits the damage.

— Robert

Make your family harder to scam

Phishing texts hit every age group, so a shared plan helps more than individual vigilance. Our free Family Safety Checkup has 20 steps you can work through together, covering phones, accounts, and the habits that stop scams from landing. If you want something for the fridge, our free printable scam and safety guides put the key rules where everyone sees them.

If you want to browse by scam type, Scam A to Z lists warning signs and guides for each one, and our family safety starting page is a good first stop for parents.

Reduce how many phishing texts you get

You cannot stop all of them, but you can cut down the risk.

• Keep your phone updated. The FCC advises updating your device’s operating system and security apps.
• Consider anti-malware software for extra protection against bad links.
• Turn on multi-factor authentication on email, banking, and shopping accounts.
• Use your phone’s spam filter and your carrier’s tools. Reporting to 7726 helps them improve.
• Do not share your number widely on forms, contests, and unknown sites.
• Do not reply to anything unexpected, even to say “wrong number.”
• Learn the broader patterns of imposter scams, since smishing is mostly impersonation.

For more on how scams work in general, our video guide to scam warning signs is a short watch that you can share with relatives.

FAQ

Can phishing be done through text messages?

Yes. Phishing by text is called smishing. The FBI uses that term for scams delivered through SMS messages. The text tries to get you to click a link, call a number, or share personal or payment information.

Should I reply STOP to a suspicious text?

No. The FCC advises not responding to suspicious texts, even if they tell you to text STOP. A reply can tell the sender your number is active. Report the message to 7726, block the number, and delete the text.

How do I know if a text from my bank is real?

Do not use the link or number in the text. Look at your card, a statement, or the bank’s official website for contact details, then call or log in on your own. If there is a real problem, the bank will confirm it there.

Where do I report phishing texts in the U.S.?

Forward the message to 7726 (SPAM) and file a report at ReportFraud.ftc.gov. You can also file a free complaint with the FCC. If you lost money or shared sensitive numbers, contact your bank and visit IdentityTheft.gov.

Why do scammers text “Hi, how are you?”

It is an opening line to start a conversation. Once you reply, the scammer builds trust and later steers you toward money, a job, or an investment. Do not respond to messages from strangers. Block and delete.

Sources

• Spoofing and Phishing, FBI
• Top text scams of 2024, Federal Trade Commission
• Avoid the Temptation of Smishing Scams, FCC
• How To Recognize and Avoid Phishing Scams, FTC Consumer Advice
• Don’t click on that random text. It’s a scam, FTC Consumer Alerts
• Recognize and Report Phishing, CISA
• How to spot a fake text message, Stop! Think Fraud
• Types of credit card fraud alerts

Recommended

• Scam Texts: How to Spot a Fake Text Message and What to Do If You Tapped the Link
• Phishing, Malware, and Ransomware: What’s the Difference?
• Crypto Investment Scams: Wrong-Number Texts to Fake Trading Apps
• Package Delivery Text Scams