A three-line message, one link and ten seconds of inattention
In short: smishing is phishing that arrives by text message. You get a short note about a parcel, a toll, a tax debt or a blocked account, with a link to a fake site. There you are asked for card details, a password, or a code that a real app just sent you, such as a WhatsApp code. A text message gives no guarantee about who sent it. The rule that protects you is simple: do not open the link, go to the official website or app yourself and check there.
Table of Contents
What is smishing
The word comes from “SMS” and “phishing”. It is the same trap as phishing, only the bait is a text message on your phone. It is one of the attack vectors, the doors scammers use to reach you.
- The attacker does not break into your phone. They convince you to tap and type something.
- A text is read fast, usually on the move. That is exactly why it works.
- The message feels personal, because it lands on your number, on a screen you trust.
If they call instead of writing, it is vishing. The two are often combined: the text pushes you to call an “urgent number”, and the same people answer.
How a text message attack unfolds
- The message. A short text with a small problem and a deadline: “parcel not delivered”, “unpaid fee”, “your account is blocked”.
- The link. An address that looks like the real one, or a shortened link that hides where it goes.
- The fake page. It copies the look of a courier, a bank or an agency.
- The request. Card details for a small “fee”, a password, or a code you received by text or in an app.
- The use. Card details are used for payments. A code is used to take over an account, and from there your contacts get scammed too.
The most common scenarios
- The parcel and the locker. In March 2026, Bitdefender described a campaign in Romania that reached more than a million people. The text looked like it came from a courier and said a parcel was linked to your number and you had to pick a locker. The fake page then asked for a “confirmation code”, which was the real WhatsApp verification code. With it, the attackers took over the account and messaged the victim’s contacts asking for money they promised to return the next day.
- The unpaid toll or parking fee. In the United States, unpaid toll texts were among the most reported text scams, and the FTC links them to a rise in government impersonation reports. In Europe the same script appears as parking or road fees.
- The tax or government notice. A text claiming a refund, a fine or a frozen account, in the name of a tax or government agency, with a link and a deadline.
- The courier and the post. A parcel is waiting, an address needs updating or a small fee is due.
- The bank. “Your card has been blocked” or “a payment from an unknown merchant”, with a link or an “urgent” number.
- Jobs and “wrong number”. A message that looks sent by mistake, or a “work from home” offer paid per task. These are among the scripts reported most often in the United States.
What's new in 2026
- Smishing is growing faster than anything else. The APWG report for the second quarter of 2026 shows smishing up 40% from the previous quarter and vishing up 20%. The figures come from Crane Authentication, an APWG member.
- The attacks are industrial. In November 2025 Google sued the Lighthouse platform, which it says affected more than a million victims in 120 countries. It was rented out as a service, with ready-made templates for banks, couriers and toll operators. The claims are Google’s, and the case has not been decided.
- The losses are large, even though the messages are short. In the United States, the FTC counted $470 million in reported losses to text scams in 2024, more than five times the 2020 figure. The most common types: fake package delivery problems, job offers, fake fraud alerts, unpaid tolls and “wrong number” texts.
- The verification code is the new target. The March campaign installed nothing on the phone. The attackers simply asked the victim to hand over the code.
The practical conclusion: a text that rushes you to a page is not a notification, it is a request. You act on it through the official channel, not through the one in the message.
Why it works
- Urgency. “Last chance”, “within 24 hours”, “or the parcel is returned”.
- Small amounts. A small fee does not feel like a problem. The real goal is your card details.
- Context. You are waiting for a parcel, you have a parked car, you have a bank account. The message often arrives at a real moment.
- Trust in the phone. A text feels more personal than an email and is read in seconds.
- Spoofed senders. The sender name can be chosen by the attacker, and sometimes the message appears in the same thread as real ones.
- Short links. You cannot see where they lead.
How to spot a scam text
- It comes from an unknown number, or from a name that resembles a company’s but is not.
- It asks you to tap a link to “confirm”, “reschedule” or “unblock” something.
- It asks for a small amount, a short deadline or threatens penalties.
- The address is not the official site: swapped letters, extra words, odd endings.
- It asks for a code that reached you by text or in an app.
- It asks you to reply with a letter, such as “Y”, so the link becomes active.
- A parcel you are not expecting or a fee you do not owe.
- Mistakes, odd wording or a tone that is too rushed.
No serious company asks for card details or a verification code through a link in a text message.
How to protect yourself
- Do not open the link. Go to the official site or app of the courier, bank or agency, typed by you in the browser.
- Codes are never shared. Not with a “courier”, not with a “bank”. A WhatsApp, banking or email code is the key to your account.
- Turn on two-step verification in WhatsApp. Settings, Account, Two-step verification. With it, an attacker who only has the SMS code cannot take over the account.
- Check any money request on WhatsApp. Call the person on their usual number, even if the message looks written by them.
- Use the courier’s official app to track parcels, not links in texts.
- Report the message in your messages app (Google Messages or iMessage) and block the number. In the United States you can also forward it to 7726 (SPAM).
- Talk to the people close to you. Tell them plainly: “A text about a parcel or a fine is never opened. Call me and we look at it together.”
- Set limits and alerts on your card. An alert on every transaction tells you within seconds.
What to do if you tapped or shared something
- If you tapped but typed nothing: close the page. Usually nothing happened, but do not open it again.
- If you typed card details: call your bank right away, on the official number, and ask to block the card.
- If you shared a WhatsApp code: reinstall the app and register your number again. Warn your contacts another way to ignore any money request from you. Then turn on two-step verification.
- If you typed a password: change it immediately on the real site and everywhere you reused it, from another device.
- Keep the evidence: the message, the number, the time and screenshots.
- Report it to the police or your national cybercrime authority, and to your bank.
Do not be embarrassed. These messages go out by the millions, and anyone can land on a rushed moment.
Frequently asked questions
What does smishing mean?
Smishing comes from “SMS” and “phishing” and means fraud by text message. A text urges you to tap a fake link or hand over a code, so your data or money can be stolen.
Can I be tricked just by tapping the link?
A tap on its own is rarely enough. The risk appears when you type card details, a password or a code on the fake page. Still, close the page, type nothing, and if you did, change your passwords.
Why do I get texts about parcels I am not expecting?
The messages are sent in bulk, to generated or leaked numbers. Statistically many recipients really are waiting for a parcel, and that is what makes them work. If you expect nothing, ignore it.
Is a text in my bank's thread safe?
Not necessarily. The sender name can be spoofed and the message can land in the same thread as real ones. Do not tap links even then: open your bank’s app and check there.
I lost my WhatsApp account. What do I do?
Reinstall the app and register your number again, then turn on two-step verification. Warn your contacts another way not to send money. If the attackers set their own PIN, you may need WhatsApp’s security reset process.
Sources and further reading
- Bitdefender, March 2026 warning: the fake courier text campaign and WhatsApp account takeovers
- APWG, Phishing Activity Trends Report, second quarter 2026
- FTC, Data Spotlight “Top text scams of 2024”, April 2025
- Google, lawsuit against the Lighthouse platform, November 2025
- Where to report: your bank first, then your national cybercrime authority or the police
Read more in this series
About the author
Brîndușa Maria, Senior Software Test Analyst, ISTQB® Certified Tester Advanced Level Test Analyst (CTAL-TA). I write about how to recognize online scams. LinkedIn
Note: this article is based on my research and professional experience. I used artificial intelligence tools for drafting and editing.
📢 Share the knowledge, stay safe! 🔒✨ Use the share buttons below and help others stay safe online. The more we know about online scams, the better protected we are! 🚀💙