What a Smishing Scam Is and What to Do
A smishing scam is a phishing attack by text. Here is what the scammer wants and what to do about it.
What is a smishing scam?
A smishing scam is a scam that arrives by text message. According to the FBI, these cons play out over text messages. The Postal Inspection Service gives an example. It says a text message claiming a USPS delivery needs a response, with a strange link, is a scam called smishing.
Smishing sits under a bigger umbrella. According to the Postal Inspection Service, smishing is phishing carried out through a text message or phone number. So if you know what phishing is, you already know most of this. Phishing is any scam that contacts you and tries to get you to hand over information or click a bad link. Smishing is the same trick, delivered to your phone instead of your email. If you want the fuller picture, read what is smishing and phishing.
The details the scammer wants from you
According to the Postal Inspection Service, the victim receives a misleading text designed to trick them into handing over personal or financial information. The scammers often pretend to be a government agency, bank, or other company to seem legitimate.
So what do they want? According to the Postal Inspection Service, the details being sought include usernames, passwords, Social Security numbers, birth dates, and card numbers. And the stolen information does not just sit there. According to the Postal Inspection Service, information taken this way fuels further crimes, including financial fraud.
The Postal Inspection Service's guide sums it up in a single sentence. It says to treat your personal information like cash. Your Social Security number and credit card numbers can be used to steal your money. Fraudsters are able to set up new accounts under your name without you knowing or agreeing to it.
The USPS delivery text
One smishing text pretends to be about a package. You get a text saying a USPS delivery needs a response, with a strange link to click. According to the Postal Inspection Service, a message like that one is a smishing scam.
One detail worth knowing. According to the Postal Inspection Service, USPS texts mobile phones using 5-digit short codes, and receives replies the same way. For more on this family of scams, see our page on the USPS scam.
What to do if you got one
Do not tap the link. Do not reply. The Postal Inspection Service advises checking who the sender really is, and asking why they want your information at all. A real company texting you about your own account has no reason to ask for your password or your card number.
According to the Postal Inspection Service, a real company will never request that you confirm or hand over personal information. Hold onto that rule. Any text that asks you to confirm details is breaking it.
If you are still unsure after checking, read our guide on is this a scam text. It walks through the signs in more depth.
How to report it
Reporting depends on whether the text pretended to involve USPS.
If it did, the Postal Inspection Service asks that you report USPS related smishing by email to spam@uspis.gov. It also says to forward the smishing text message to 7726 to help report the scam phone number. The Postal Inspection Service will reach out to you if it needs anything further.
If the text was not about USPS, you have other places to report it. According to the Postal Inspection Service, smishing complaints that have nothing to do with USPS can be filed with its law enforcement partners as well. It says non-USPS smishing complaints can be reported to the Federal Trade Commission. The FBI's Internet Crime Complaint Center takes those complaints too.
Reporting does not get your money back.
If you already clicked or replied
Maybe you tapped the link before you realized what it was. Maybe you typed something into the page it opened. The Postal Inspection Service gives clear guidance for this situation. It says if you already interacted with the link, even without clicking submit, notify your financial institution.
Read that carefully. Even without clicking submit. If you entered your bank login or your card number on the page and then backed out, tell your bank anyway. The scammer may already have what they need.
How to protect yourself going forward
A few habits make these texts less dangerous.
The Postal Inspection Service's guide urges wariness toward texts from senders you do not know. That is the first habit.
You can also shut some of this out at the carrier level. The guide says a call to your carrier's customer service line can get spam messages blocked. It also says your account on the carrier's website may let you switch on message blocks yourself.
Then keep watch on your bills. The guide says to review your cell phone bill for unauthorized charges and report them to your carrier.
Finally, keep your phone's defenses current. The guide says to keep your security software and applications up to date on your cell phone.
For a broader look at scam texts of every kind, see our page on the scam text message.