SMS from a stranger with a link: how to tell if it is a scam

SMS from a stranger with a link: how to tell if it is a scam

"Your parcel is on hold", "your account will be suspended", "you have an unpaid fine"... followed by a link. Smishing (phishing by SMS) keeps finding new disguises, and reports from the NoCall community confirm it: when an unexpected SMS carries a link, the rule is to be suspicious first and verify afterwards.

1. The 4 signs of smishing

• You were not expecting it — you have not ordered a parcel or started any application.
• It rushes you — "within 24 hours", "final notice", "account suspended immediately".
• The sender does not add up — a personal mobile number instead of the bank's or the company's name. Government SMS should come from the "gov.sg" sender ID.
• It asks for details or a payment — no bank or government agency asks for passwords or one-time codes by SMS.

2. Inspect the link without tapping it

Long-press the link to see the full address without opening it. Be wary of misspelt domains, URL shorteners and odd extensions. When in doubt, open the official app or type the address yourself: never go in through the link in the SMS.

3. If you have already tapped it

Do not enter any details, and close the page. If you shared banking details, call your bank as soon as possible or use its emergency "kill switch" to freeze your accounts; if you installed an app, remove it, run a security scan and, if you bank on that phone, tell your bank too.

4. Report the SMS

Report the message through the ScamShield app or website, block the sender, and report it on NoCall with a screenshot to warn other users. If you lost money, make a police report online through SPF e-services.

How do I know if an SMS with a link is a scam?

Be suspicious if you were not expecting the message, if it rushes you ("your account will be suspended"), if the sender is a personal mobile number, or if the link points to a strange domain. Banks and government agencies never ask for passwords by SMS, and according to the IRAS scam advisory, government SMS should come from "gov.sg".

I tapped a suspicious link. What do I do?

Do not enter any details, close the page and do not download any files. If you gave banking details, call your bank immediately; if you installed an app, remove it, run a security scan and, if you bank on that phone, tell your bank too. If you are not sure whether it was a scam, call the ScamShield Helpline on 1799.

Where do I report a smishing SMS?

Report it through the ScamShield app or website, report it on NoCall with a screenshot, and if you lost money, make a police report. IMDA's anti-scam measures for SMS, including the SMS Sender ID Registry, work at network level, but your report still helps to warn others.