A text from an unknown number with a link: how to tell if it's a scam

A text from an unknown number with a link: how to tell if it's a scam

"Your parcel is on hold", "your account will be suspended", "you have an unpaid fine"... followed by a link. Smishing (phishing by text message) is one of the fastest-growing scams, and reports from the NoCall community confirm it: when an unexpected text arrives with a link, the rule is to be suspicious first and check afterwards.

1. The 4 signs of smishing

• You weren't expecting it — you haven't ordered a parcel or started any process.
• It pressures you — "within 24 hours", "final notice", "account suspended immediately".
• The sender doesn't add up — a personal mobile number instead of the bank's or company's name.
• It asks for details or a payment — no bank or government department asks for your passwords by text.

2. Check the link without tapping it

Press and hold the link to see the full address without opening it. Be wary of misspelt or lookalike domains (r0yalmail, evri-redelivery), link shorteners and odd endings. If in doubt, open the official app or type the address in yourself: never go in through the link in the text.

3. If you've already tapped it

Don't enter any details and close the page. If you gave out your bank details, call your bank as soon as possible; if you installed an app, uninstall it and run a security scan.

4. Report the text

Forward the message to 7726 (the number spells SPAM on the keypad), free on most UK networks, so your provider can investigate and block the sender; HMRC asks for texts that use its name to be forwarded to 60599 instead. Then block the number and report it on NoCall with a screenshot to warn other users. If you've lost money, report it to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101.

How do I know if a text with a link is a scam?

Be suspicious if you weren't expecting the message, it puts pressure on you ("your account will be suspended"), the sender is a personal mobile number or the link points to a strange domain. Banks and government departments never ask for passwords by text.

I tapped a suspicious link: what do I do?

Don't enter any details, close the page and don't download any files. If you gave out bank details, call your bank immediately; if you installed an app, uninstall it and run a security scan.

Where do I report a scam text?

Forward it to 7726, as the National Cyber Security Centre explains, report it on NoCall with a screenshot and, if you've lost money, report it to Report Fraud or, in Scotland, to Police Scotland. GOV.UK and the NCSC's phishing guidance explain how to report other scam messages.