A text from an unknown number with a link: how to tell if it's a scam

A text from an unknown number with a link: how to tell if it's a scam

"Your parcel is on hold", "your account will be suspended", "you have an unpaid toll"... followed by a link. Smishing (phishing by text message) is everywhere, and reports from the NoCall community back that up: when an unexpected text arrives with a link, the rule is to be suspicious first and check afterwards.

1. The 4 signs of smishing

• You weren't expecting it: you haven't ordered anything or started any process.
• It rushes you: "within 24 hours", "final notice", "immediate suspension".
• The sender doesn't add up: a personal 04 mobile number instead of the bank's or company's name.
• It asks for details or a payment: no bank or government agency asks for your passwords by text.

2. Inspect the link without tapping it

Press and hold the link to see the full address without opening it. Be wary of misspelt or lookalike domains (like "myg0v" or "auspost-redelivery"), link shorteners and odd endings. When in doubt, open the official app or type the address yourself: never go in through the link in the text. The Australian Communications and Media Authority (ACMA) also oversees an SMS Sender ID Register for organisations that text under a brand name, but a familiar sender name on its own never proves a text is genuine.

3. If you've already tapped

Don't enter any details, and close the page. If you gave your banking details, call your bank as soon as possible; if you installed an app, remove it and run a security scan.

4. Report the text

Report it on NoCall with a screenshot to warn other users, and block the sender. If you're with Telstra, Android users can forward the text to 7226 and then delete it, and iPhone users can use "Report Junk", as Telstra's scams page explains; other carriers have their own options, so check with yours. You can also report it to Scamwatch, the national scam-reporting service, and if you lost money, report it to police through ReportCyber, linked from the AFP's cybercrime page.

How do I know if a text with a link is a scam?

Be suspicious if you weren't expecting the message, it rushes you ("your account will be suspended"), the sender is a personal mobile number, or the link points to a strange domain. Banks and government agencies never ask for your passwords by text.

I tapped a suspicious link: what do I do?

Don't enter any details, close the page and don't download any files. If you gave your banking details, call your bank immediately; if you installed an app, remove it and run a security scan.

Where do I report a scam text?

Telstra customers can forward it to 7226 (Android) or use "Report Junk" (iPhone); other carriers have their own options. Report it on NoCall with a screenshot and to Scamwatch, and if you lost money, to police. If your provider doesn't help with scam texts on your service, complain to the Telecommunications Industry Ombudsman (TIO).