Glossary · definition
What is smishing? How text message scams work
Smishing is phishing sent by SMS: a text that pretends to come from a delivery company, a toll agency, a bank or a friend, and pushes you to tap a link, reply or share a code. It is one of the most reported scams in the US. This page explains how smishing works, what the official data says and the habits that keep you safe.
Quick answer
What is smishing?
Smishing (SMS phishing) is a scam text that pretends to come from a trusted company or person and tries to make you tap a link, share a verification code or send money. The FTC says people reported losing $470 million to scams that started with a text in 2024. Never act on links in unexpected texts.
How does smishing work?
A smishing text creates urgency and offers an easy fix. A package cannot be delivered, a toll is unpaid, a card was charged, an account will be locked. The link leads to a convincing copy of a real site that asks for card details, a login or a one-time code, or the text asks you to reply or call a number.
Some scams aim straight at your verification codes. A message may say a code was sent by mistake and ask you to forward it, or a fake support agent may text you before triggering a real login. The FTC's 2021 alert on the Google Voice verification code scam describes this pattern. Anyone who gets your code can sign in as you.
How common is smishing?
Very. In its April 2025 Data Spotlight, the FTC reported that people lost $470 million in 2024 to scams that started with a text message, five times the 2020 figure, with fake package delivery problems, bogus job offers, fake fraud alerts, unpaid toll notices and wrong-number texts among the most common.
The FBI's Internet Crime Complaint Center counts phishing by email, text and phone together. Its 2025 Internet Crime Report lists 191,561 phishing and spoofing complaints, the most of any category, with reported losses of $215,843,126. In April 2024, the IC3 also warned about a wave of fake unpaid-toll texts after receiving more than 2,000 complaints.
| Source | Period | Figure |
|---|---|---|
| FTC Data Spotlight (April 2025) | 2024 | $470 million reported lost to scams that started with a text |
| FBI IC3 Internet Crime Report | 2025 | 191,561 phishing/spoofing complaints (email, text and phone) |
| FBI IC3 Internet Crime Report | 2025 | $215,843,126 reported phishing/spoofing losses |
| FBI IC3 PSA240412 | April 2024 | More than 2,000 complaints about fake toll texts in about a month |
How do you spot a smishing text?
Most scam texts share a few signs. One is enough to slow down.
- You did not expect it, or it is about an order, toll or account you do not recognize.
- It is urgent: pay today, confirm now, or your account will be closed.
- The link uses a shortened or odd domain instead of the company's real website.
- It asks for a verification code, a password, card details or a gift card.
- It comes from an unknown number or an email address rather than the company's usual sender.
What should you do with a smishing text?
Do not tap the link or reply, not even STOP to a number you do not recognize. If the message might be real, open the company's app or type its website address yourself. Forward the text to 7726 (SPAM) so your carrier can block the sender, then report it at ReportFraud.ftc.gov. The FCC's 2023 robotext rules (FCC 23-21) also require mobile carriers to block texts from invalid and unallocated numbers.
If you already tapped a link or entered details, act fast: change the password for that account, call your bank using the number on your card, and enable an authenticator app or passkey. If you shared a verification code, assume the account is at risk.
Does keeping your number private reduce smishing?
It helps. The fewer sites that store your real number, the fewer lists it ends up on after a data breach. For one-time sign-ups on accounts you own, a temporary number from TempSMSVerify keeps your personal number out of that site's database, and it expires after up to 20 minutes. Keep your real number, protected by a carrier PIN, for banking and important accounts. See /glossary/sim-swap for the related number-takeover scam.
FAQ
Smishing: FAQ
What does smishing mean?
Smishing combines SMS and phishing. It means a fraudulent text message designed to trick you into tapping a malicious link, sharing personal information or a verification code, or sending money. The same scams also arrive through messaging apps such as WhatsApp and iMessage, even though they do not use SMS.
What happens if I click a smishing link?
Usually you land on a fake site that asks for card details, a login or a one-time code; nothing is stolen until you enter something. If you entered data, change that password, call your bank using the number on your card and watch your accounts. On some phones, links may try to install apps, so do not accept downloads.
Should I reply STOP to a scam text?
No, not to a number you do not recognize. Replying confirms your number is active and may bring more scam texts. STOP is meant for legitimate senders you signed up with. For scam texts, forward the message to 7726 (SPAM), report it at ReportFraud.ftc.gov and then delete it.
How much money is lost to smishing?
The FTC reported in April 2025 that people lost $470 million in 2024 to scams that started with a text message, five times the 2020 total. The FBI's 2025 Internet Crime Report lists $215,843,126 in phishing and spoofing losses across email, text and phone. Many victims never report, so real losses are higher.
What are the most common smishing scams?
According to the FTC's April 2025 Data Spotlight, the most common text scams include fake package delivery problems, bogus job offers and task scams, fake fraud alerts from banks, unpaid toll notices and wrong-number texts that start a conversation. The FBI has issued separate warnings about fake toll texts since April 2024.
How do I report smishing?
Forward the text to 7726, which spells SPAM, so your carrier can investigate and block the sender. Report it to the FTC at ReportFraud.ftc.gov, and if you lost money, file a complaint with the FBI at ic3.gov. Then delete the message, and contact your bank right away if you shared payment details.
Can someone hack my phone through a text?
Simply reading a text is very unlikely to harm a phone that has current updates. The danger is in what you do next: tapping a link, installing an app it suggests, entering a code or replying with information. Keep your phone updated, never install apps from text links and treat unexpected messages with suspicion.
Last updated:
Ready when you are
Get your verification code now
Create an account, top up and pick a number. Pay only if the code arrives.