Key takeaways
- A text that creates urgency and contains a link is suspicious by default.
- Check the sender’s claim by opening the official app or typing the website yourself.
- If you entered card details, call your bank right away; if you entered a password, change it.
- Forward scam texts to your operator’s reporting number, then delete them.
“Your parcel is held, pay €1.99 to release it.” “Unusual activity on your account, verify now.” “You have an unpaid fine.” Phishing texts (also called smishing) are sent by the million, in every language. They work because they look ordinary and arrive when you’re busy. Learn the signs once, and you’ll spot them for life.
Seven signs of a phishing text
- Urgency or a threat: “today”, “last notice”, “your account will be blocked”.
- A link, often shortened or with a strange domain (extra words, misspellings, unusual endings).
- A small payment: delivery fees, customs, a toll, a fine. The real goal is your card details.
- A generic greeting or none: “Dear customer”.
- A request for a code, a password or personal data.
- An unknown or foreign number, or a sender name that just looks right.
- A context that doesn’t fit: you weren’t expecting a parcel, you don’t have an account with that bank.
Scammers can make texts appear in the same conversation thread as real messages from a company. A familiar thread isn’t proof that a message is genuine.
What to do instead of clicking
Open the company’s official app, or type its website address yourself, and check there. For a bank, call the number on your card. For a parcel, use the tracking number from the shop’s own confirmation email. Real issues will be visible there too.
If you clicked the link
- Just clicking is rarely enough to infect a modern phone. Close the page and don’t enter anything.
- If you entered card details: call your bank and block the card (see /blog/bank-card-fraud-what-to-do/).
- If you entered a password: change it on the real site and everywhere you reused it, and enable two-step verification.
- If you installed an app or profile at the site’s request: remove it, and ask for help if unsure.
- Expect follow-up calls from fake “bank advisers” referring to your “recent payment”: hang up.
Report it
Forward the text to your operator’s spam number where it exists (7726 in the UK and the US, 33700 in France), report it in your messaging app, then delete it. If you lost money, report it to the police or your fraud service (see /blog/how-to-report-an-online-scam/).
Protect your family
Older relatives and teenagers are common targets. Share one simple rule with them: never pay or enter codes from a text link, always check in the official app. Our /blog/most-common-online-scams-and-how-to-spot-them/ guide lists other scams to watch for.
Frequently asked questions
How did they get my number?
Often they didn’t target you: numbers are generated or taken from data leaks and texted in bulk. Receiving one doesn’t mean your bank or courier was hacked.
Should I reply STOP to a scam text?
No. Replying confirms your number is active. Report and delete it instead.
Is it safe to open a scam text without clicking?
Yes, reading a text is safe. The risk is in tapping the link, calling the number, or replying.
General information to help you get organised, not legal advice. Procedures and numbers can change: confirm them with the office concerned, and in danger call your local emergency number first.
