A text with a link from an unknown number: how to tell if it's a scam

A text with a link from an unknown number: how to tell if it's a scam

"Your parcel is on hold", "your account will be locked", "you have an unpaid fine"... followed by a link. Smishing (phishing by text message) is everywhere, and reports from the NoCall community confirm it: when an unexpected text arrives with a link, the rule is to be suspicious first and check afterwards.

1. The 4 signs of smishing

• You weren't expecting it — you haven't ordered a parcel or started anything.
• It rushes you — "within 24 hours", "final notice", "account locked immediately".
• The sender doesn't add up — a personal mobile number (021, 022, 027...) instead of the bank's or company's name.
• It asks for details or a payment — no bank or government agency asks for your password by text.

2. Check the link without tapping it

Press and hold the link to see the full address without opening it. Be wary of misspelt domains, link shorteners and odd extensions. If in doubt, open the official app or type the address in yourself: never go in through the link in the text. Own Your Online's scam check can also help you decide.

3. If you've already tapped

Don't enter any details, and close the page. If you gave out bank details, call your bank as soon as possible; if you installed an app, remove it and run a security scan.

4. Report the text

Forward the text free to 7726 (it spells SPAM on the keypad), the scam-text reporting service run by the Department of Internal Affairs (Te Tari Taiwhenua); on supported iPhones, the one-tap "Report Junk" option does the job too. Then block the number and report it on NoCall with a screenshot to warn other users. If you've lost money, call your bank and report it to NZ Police on 105.

How do I know if a text with a link is a scam?

Be suspicious if you weren't expecting the message, it rushes you ("your account will be locked"), the sender is a personal mobile number, or the link points to a strange domain. Banks and government agencies never ask for passwords by text.

I've tapped a suspicious link. What do I do?

Don't enter any details, close the page and don't download any files. If you gave out bank details, call your bank straight away; if you installed an app, remove it and run a security scan.

Where do I report a smishing text?

Forward it free to 7726, report it on NoCall with a screenshot and, if you've lost money, report it to NZ Police on 105 or online. You can also report scams to the National Cyber Security Centre (NCSC).