SMS phishing (smishing): how to spot scam texts, report them, and recover if you tapped

Breach / exposure. Updated 2026-09-13. About 5 minutes to read.

Never act on a link, number or code request in an unexpected text: report it to 7726 or your carrier's scam number, delete it, and open the real app instead.

Smishing is phishing by text message. It works because texts feel personal, arrive on the device you use for banking, and hide the real link destination better than email. The messages are short, urgent and usually about something you might genuinely be expecting: a toll, a parcel, a bank alert, a government payment.

This guide covers the scam texts in circulation in 2026, the red flags that are specific to SMS, how to report and filter them in the US, UK, Australia and Canada, and what to do if you already tapped the link.

One rule covers most of it. Never act on a link or phone number in a text you did not expect. Open the organisation's app or type its website address yourself.

The scam texts doing the rounds

  • Unpaid toll: a small amount owed on a toll road account with a late fee threat. In the US these name E-ZPass or state toll agencies. In Australia they name Linkt.
  • Parcel on hold: a courier needs a redelivery fee or address update. USPS, Australia Post, Royal Mail and Evri are common names.
  • Bank fraud alert: reply YES or NO to a suspicious payment, then a call from a fake fraud team who asks you to move money or read out a code.
  • Hi Mum or Hi Dad: a child has a new number and needs money urgently.
  • Government: a tax refund, a myGov or HMRC notice, or a benefit payment that needs confirming.
  • Wrong number: a friendly message to the wrong person that becomes a long chat and ends in an investment or crypto pitch.
  • Job offer: easy remote work for high pay, moving to WhatsApp or Telegram.

Red flags that are specific to text messages

  • The sender is an overseas number, an email address, or a mobile number for a company that normally texts from a short code or name.
  • The link domain does not belong to the organisation, or uses a shortener.
  • The text asks you to reply Y or 1 to activate the link. iPhone disables links from unknown senders until you reply, and replying also confirms your number is active.
  • A deadline measured in hours, or a threat of fines, suspension or legal action.
  • A request for a verification code you just received. That code is the key to your account, and scammers trigger it by trying to log in as you.

Do not reply STOP to a text you did not sign up for. STOP works for legitimate marketing lists, but on a scam text it simply confirms your number is live.

Report it in under a minute

  1. United States and Canada: long press the message, choose Forward, send it to 7726, which spells SPAM, and follow any prompt asking for the sender's number. In the US, also report at ReportFraud.ftc.gov.
  2. United Kingdom: forward the text to 7726. It is free on all major networks.
  3. Australia: Telstra customers can forward scam texts free to 7226. On any network you can forward spam texts to the ACMA on 0429 999 888, where standard rates apply, and report the scam at scamwatch.gov.au.
  4. Use the report button in your messaging app too. On iPhone, tap Report Junk under a message from an unknown sender. In Google Messages, long press the conversation and choose Block, then Report spam.
  5. Delete the message once reported.

Australia's SMS Sender ID Register became mandatory on 1 July 2026. Businesses must register the names they send texts under, and messages using unregistered brand names are flagged or blocked by carriers, which makes impersonating a bank or courier name harder but does not stop scams sent from ordinary numbers.

Filter unknown senders on iPhone and Android

  1. iPhone on iOS 26: open Settings, tap Apps, then Messages, scroll to Unknown Senders and turn on Screen Unknown Senders. Messages from numbers not in your contacts move to a separate list without notifications.
  2. On older iPhones, the same area offers Filter Unknown Senders.
  3. Android with Google Messages: tap your profile picture, then Messages settings, then Spam protection, and turn on Enable spam protection.
  4. Check your carrier's free scam filtering, such as T-Mobile Scam Shield, Verizon Call Filter or AT&T ActiveArmor in the US.

If you tapped the link or replied

  1. Tapped but entered nothing: close the page, do not download anything, and update your phone's operating system.
  2. Entered a password: change it on the real site or app now, change it anywhere you reused it, and turn on two factor authentication with an authenticator app or passkey.
  3. Entered card details: call your card issuer on the number on the card or in its app, block the card and dispute any charges.
  4. Installed an app or profile the text asked for: delete it, and on iPhone check Settings, then General, then VPN and Device Management for unknown profiles.
  5. Gave personal ID details: report identity theft at IdentityTheft.gov in the US, contact IDCARE on 1800 595 160 in Australia, or use Report Fraud in the UK.

When a scam text is the start of a SIM swap

Some smishing is aimed at your mobile carrier account itself. A text claims your bill failed or your SIM needs upgrading, the link captures your carrier login, and the attacker uses it to move your number to their own SIM. From there, every text code goes to them.

If a text about your mobile account asks you to log in, go to the carrier's app instead. Then set a carrier account PIN and turn on the free number lock your carrier offers, such as Verizon Number Lock, AT&T Wireless Account Lock or T-Mobile SIM Protection.

Frequently asked questions

Is it safe to open a scam text message?

Reading a text is safe. The risk comes from tapping links, replying, calling the number or installing anything it suggests. Report it and delete it without interacting.

Does forwarding a text to 7726 cost anything?

In the US, UK and Canada, forwarding to 7726 is free on major carriers. In Australia, Telstra's 7226 service is free, while forwarding to the ACMA's 0429 999 888 number is charged at standard rates.

Why am I suddenly getting so many scam texts?

Scammers send to huge lists of numbers from breaches, data brokers and random number generation. Once your number responds or appears in a new breach, it gets added to more lists. Never reply, and remove your number from people search sites.

What is the toll road scam text?

It is a text claiming you owe a small unpaid toll with a late fee, linking to a fake payment page that steals card details. Toll agencies do not usually demand payment by text link. Check your account through the official app or website.

Should I reply STOP to spam texts?

Only to marketing texts from companies you knowingly signed up with. On scam texts, replying STOP confirms your number is active and can increase the number of scam messages you receive.

Tools that help

Related guides

Sources