Text from an unknown number with a link: how to tell if it's a scam
You get an unexpected text with a link: a package, your bank, or an unpaid toll. Learn how to spot smishing before you tap.
Summarize this article with
Text from an unknown number with a link: how to tell if it's a scam
"Your package is on hold," "your account will be locked," "you have an unpaid toll"... followed by a link. That's smishing (phishing by text message), and reports from the NoCall community show how often it happens: when an unexpected text comes with a link, the rule is to distrust first and verify later.
1. The 4 signs of smishing
- You weren't expecting it: you didn't order anything or start any process.
- It rushes you: "within 24 hours," "final notice," "account locked immediately."
- The sender doesn't add up: a random 10-digit number or an email address, not the number your bank or the company normally texts you from.
- It asks for information or a payment: no bank or government agency asks for your password by text.
2. Check the link without tapping it
Press and hold the link to see the full address without opening it. Be wary of misspelled domains ("amaz0n", "usps-redelivery-help"), URL shorteners, and odd endings. When in doubt, open the official app or type the address yourself: never go in through the link in the text.
3. If you already tapped
Don't enter any information, and close the page. If you gave out bank details, call your bank as soon as possible; if you installed an app, uninstall it and run a security scan.
4. Report the text
Forward the message to 7726 (SPAM) so your carrier can block similar texts, block the sender, and report it in the NoCall spam numbers directory with a screenshot to warn other users. Report it at ReportFraud.ftc.gov too, and if you lost money, file a report with your local police and with the FBI's IC3.
How do I know if a text with a link is a scam?
Be suspicious if you weren't expecting the message, it rushes you ("your account will be locked"), the sender is a random 10-digit number or an email address, or the link points to a strange domain. Banks and government agencies never ask for your password by text.
I tapped a suspicious link. What do I do?
Don't enter any information, close the page, and don't download any files. If you gave out bank details, call your bank right away; if you installed an app, uninstall it and run a security scan.
Where do I report a smishing text?
Forward it to 7726 (SPAM), report it on NoCall with a screenshot and at ReportFraud.ftc.gov, and if you lost money, file a report with your local police and the FBI's IC3.
Sources and review
Reviewed:
Numbering, carrier tools, and reporting procedures can change. Verify sensitive steps with the linked primary authority.
Article details
Editorial content reviewed by NoCall with practical context for spotting suspicious calls and messages.
Received a suspicious call?
Look up the number in NoCall before sharing data, calling back, or clicking any link.
Search a phone number or a company name (Bank of America, Verizon and AT&T...) to check if it has been reported as spam.