What is smishing: how to spot fake SMS texts
Smishing (SMS + phishing) is the scam that arrives by text message: an SMS that looks like it comes from your bank, the post office, or the tax agency, with a link to a fake website that steals your passwords or installs malware. The NoCall community has gathered more than 0 reports about numbers sending these messages.
How smishing works
The scammer sends thousands of messages with a believable hook —a held parcel, a suspicious charge, a tax refund— and a shortened link leading to a copy of the official website. Only a small fraction needs to tap for the campaign to pay off. It is the SMS version of phone vishing.
Signs of a fake text
- Artificial urgency — “your account will be blocked in 24h” or “final notice” to make you act without thinking.
- Suspicious link — URL shorteners or domains mimicking the official one (banc0, p0stal, with letters swapped for numbers).
- Asks for passwords or banking details — no bank or public agency requests them by SMS.
- Odd sender — a personal mobile number while pretending to be a company, or a sender name with spelling mistakes.
What to do when you get one
Do not tap the link or reply. Replying confirms your number is active and puts you in the crosshairs of more campaigns.
Block the sender and report it on NoCall, where more than 54,562 numbers are already identified, to warn other users. If the message impersonates your bank, tell them too through their official channel.
If you already tapped the link
If you only opened the page, close it and delete the message. If you entered passwords or card details, change them from the official website, alert your bank immediately to block transactions, and watch your statements over the next few days. If a suspicious call is involved, see what to do about a suspicious call.