Spot Fake Texts
'Your package could not be delivered' — from a number you do not know, with a link you should not tap. Smishing (SMS phishing) is the fastest-growing scam channel because texts get read and links get tapped. The good news: fake texts share tells, and five seconds of checking beats every single one.
TL;DR / Quick Fix
Quick fix: never tap links in unexpected texts — go to the official app or site directly instead. Check the sender: real companies text from short codes or verified names, not random long numbers. When in doubt, delete it. No legitimate delivery fails via a random text link.
Follow these steps
- Know the classic lures. Package delivery, bank alerts, toll fees, 'you won' — the greatest hits of smishing. Unexpected plus urgent plus a link equals suspicious until proven otherwise.
- Inspect the sender. Random 10-digit numbers, odd country codes, and lookalike names are red flags. Real senders use short codes or verified business profiles — and even those can be spoofed, so stay sharp.
- Never tap the link. The golden rule. Open the company's official app or type its address yourself. The link is the trap — everything downstream of the tap is the attacker's stage.
- Check for the tells. Urgency ('act now'), threats ('account suspended'), and generic greetings ('dear customer') are the classic trio. Legitimate messages are specific and calm.
- Report it. Forward the text to 7726 (SPAM) on most carriers, and use your phone's report-junk option. Reporting feeds the filters that protect everyone.
- Delete and move on. After reporting, delete the thread. Lingering scam texts get tapped accidentally later — out of sight, out of danger.
What NOT to do
- Do not tap links in unexpected texts. Ever. The official app exists precisely so you never need the text's link.
- Do not reply STOP to scam texts. Replying confirms your number is live — silence and report instead.
- Do not trust caller ID or sender names. Both are spoofable in minutes — the content and the link are what you judge.
- Do not panic at threats. 'Your account will be closed' is theater — real institutions do not threaten via text link.
Frequently asked questions
What should I do if I already tapped?
Do not enter any information. Close the page, and if you entered credentials, change them immediately from the official site — then watch the account.
Are package texts ever real?
Rarely via random links — real carriers send tracking updates you signed up for, usually without links. When unsure, check the official app.
Can my carrier block these?
Partially — spam filters catch many, and reporting to 7726 improves them. But new numbers appear constantly; your judgment is the real filter.