What is smishing?

Purpose

Smishing is deception by SMS that impersonates an organization to obtain money, information or codes. Check the sender, text and domain before acting; confirm requests through an official channel you already know.

Paste the text you received and we’ll instantly tell you whether it shows the typical signs of smishing: shortened links, domains imitating banks or couriers, and urgent pressure.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Include the complete message. You do not need to open links or share personal codes.

How to use it

1. 1

   Include the complete message. You do not need to open links or share personal codes.

2. 2

   Check message

3. 3

   Do not share passwords, PINs or verification codes in response to a text message.

4. 4

   Check the link’s real domain: "bank-security.com" is not your bank’s website.

5. 5

   Urgency ("final notice", "account blocked") is a scammer’s favourite tool.

6. 6

   When in doubt, open the official website or app yourself instead of tapping the link.

Synthetic example

DHL: Last warning. Your parcel is blocked. Action required at https://parcel.example

Interpret the result

Don’t tap the link, don’t reply and don’t share any details. Delete it and, if unsure, contact the company through its official website or number.

It shows some scam signs. Don’t open the link; check directly on the official website or app.

Only domains are displayed, without active links. A familiar domain does not prove a message is genuine.

Limitations

Indicative result based on automatic signals, not sender verification. No result guarantees that a message is safe.

Troubleshooting

Paste the message text to check it.

Use with the API

Local rule-engine check of one SMS: scam, suspicious or likely safe, with the integer score behind it (4 or more scam, 2–3 suspicious, 0–1 likely safe), signals, hosts, link flags and the named brand with its sms-brand id.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/smishing
POST https://api.nocall.io/v2/tools  {"tool":"smishing","message":"CORREOS: su paquete está retenido. Pague urgente las tasas en https://correos-entrega.info/pago","country":"ES"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/smishing' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"message":"CORREOS: su paquete está retenido. Pague urgente las tasas en https://correos-entrega.info/pago","country":"ES"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/smishing',
    method='POST',
    data=json.dumps({'message': 'CORREOS: su paquete está retenido. Pague urgente las tasas en https://correos-entrega.info/pago', 'country': 'ES'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/smishing', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ message: 'CORREOS: su paquete está retenido. Pague urgente las tasas en https://correos-entrega.info/pago', country: 'ES' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "smishing",
    "result": {
      "verdict": "scam",
      "score": 9,
      "attention": true,
      "signals": [
        "suspicious_domain",
        "risky_tld",
        "urgency",
        "brand_impersonation",
        "delivery_lure"
      ],
      "hosts": [
        "correos-entrega.info"
      ],
      "linkFlags": [],
      "brand": "correos",
      "brandSlug": "correos"
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Related guides

• Asked for a code sent by SMS?
• Where to report a scam text
• Check if a text message is a scam