Suspicious text message or smishing link? What to do next
Smishing is phishing by text message. Fake delivery notices, toll texts, bank alerts, account warnings, payment requests, and short links can push you to click, reply, enter information, share a code, or pay a fee.
By ScamClarity Editorial Team
Reviewed by ScamClarity Safety Review
Published May 20, 2026 ยท Updated May 20, 2026
Smishing is phishing by text message. The text is trying to make you act from your phone before you check whether the message is real: tap a link, reply, call a number, enter a code, pay a small fee, or verify an account.
The risk depends on what happened after the text arrived. A message you ignored is different from a link you opened. A link you opened is different from a form you submitted. A verification code or card number changes the situation again.
What happened after the text arrived?
Use the closest match. If more than one applies, start with the one involving a code, payment, account login, personal information, download, or phone change.
I only received the text
Lower risk
If you did not tap, reply, call, open a link, or enter information, the main job is to verify outside the text and report or delete it.
Open the real app or website yourself if you need to check the claim. Use a known phone number, saved bookmark, or official account page.
Look for pressure around delivery, tolls, banking, payment failure, account lock, or verification.
Use your phone's report junk or spam option when available.
Do not: Do not tap the link or call the number in the text to prove the message is real.
I clicked the link but entered nothing
Check closely
Opening a text link is not the same as giving a password, card number, or code. The next question is what loaded or what the page asked you to do.
Close the page. Check whether anything downloaded, whether an app or profile prompt appeared, and whether the page asked for payment, login, or identity details.
If the page did not load, avoid trying the link again.
If you closed it right away and entered nothing, treat it differently from account or payment exposure.
On iPhone or Android, look for app install prompts, configuration profiles, files, browser permissions, or unusual redirects.
Do not: Do not reset the whole phone only because you tapped once. Look for downloads, prompts, profile installs, or account changes first.
I replied to the text
Check closely
A reply usually does not give someone control of your phone, but it can confirm the number is active and invite more messages.
Stop replying. Block or report the sender through your phone or carrier tools. Think through whether you gave a name, address, account detail, or code.
If you replied YES, Y, STOP, NO, or a similar short answer, watch for follow-up texts and calls.
If you replied with private information, treat that information as shared.
Do not: Do not keep arguing, testing the sender, or asking who they are.
I typed information but did not submit
Check closely
If you typed sensitive details into a suspicious page, treat them as possibly exposed when you cannot tell whether the page captured them.
Act based on what you typed. Passwords and codes point to account checks. Card, bank, SSN, or identity details point to provider and identity-risk checks.
Watch for an error screen, spinner, redirect, autofill, or payment failure message.
If a password manager filled the page, review that account.
Do not: Do not keep typing or refreshing to see whether the form works.
I entered a password or one-time code
Act quickly
A password can let someone sign in. A one-time code can approve a login, password reset, device registration, account change, or payment.
Go to the real app or website yourself and change the affected password. Review recent sign-ins, recovery settings, security alerts, and connected devices.
Change the same password anywhere else you reused it.
If the code was for a bank, payment app, Apple ID, Google account, Microsoft account, email, or phone carrier, contact that provider through official support.
Do not: Do not share another code with anyone who texts or calls after the first message.
I entered card, bank, SSN, or personal information
Act quickly
Fake delivery fees, toll payments, and account verification pages often use small requests to collect valuable financial or identity details.
Contact the card issuer, bank, payment app, account provider, or identity resource that matches what you entered.
Card or bank details: ask the provider about replacement, monitoring, disputes, and pending charges.
SSN, date of birth, ID image, or tax information: use IdentityTheft.gov if identity theft or misuse applies.
Name, address, email, and phone: expect more targeted texts, calls, or emails.
Do not: Do not send more private details to someone who promises to fix the problem for a fee.
I paid a small fee
Urgent
A small delivery or toll fee can be the hook. The larger risk may be the card, bank, or payment account details entered to pay it.
Contact the payment provider quickly using the official app, website, card number, or statement phone number.
Save the receipt, transaction ID, amount, date, sender number, link, and screenshots.
Ask what can be blocked, disputed, replaced, or monitored.
Do not: Do not call the number in the text for a refund or cancellation.
I downloaded an app, profile, or file
Check closely
A text link may open a browser page, but it becomes more serious if it asked you to install an app, configuration profile, file, or permission.
Do not open the download again. Remove unknown apps or profiles and review phone settings, browser permissions, and account sign-ins.
On iPhone, look for configuration profile prompts or calendar/profile changes.
On Android, look for APK installs, app permissions, notification permissions, or browser downloads.
If this involved a work or school account, contact the right IT support team.
Do not: Do not install an app or profile because a text says it is needed for delivery, toll payment, bank security, or account verification.
My phone or account seems different
Check closely
Focus on specific signs instead of every normal phone glitch. The useful checks are downloads, prompts, account sessions, payments, and settings.
Check for unknown apps, profiles, browser changes, new permissions, unfamiliar account sign-ins, changed recovery details, and payment activity.
If only one suspicious link opened and nothing else changed, that is different from a new app, profile, or account alert.
If an account was involved, review that account from the real app or website.
Do not: Do not assume every battery drain, spam message, or slow page proves the phone is hacked.
I need to report it
Check closely
Reporting is useful even if you did not lose money. Scam texts help carriers, platforms, companies, and agencies spot patterns.
Save the text first. Then report it through your messaging app, forward it to 7726 when applicable, and use official reporting options for fraud, losses, or impersonation.
For USPS-style texts, USPIS asks for the message, sender number, date, screenshot, and details about any interaction.
For toll texts, IC3 asks for the sender number and website listed in the text.
Do not: Do not post full card numbers, SSNs, passwords, or private screenshots in public forums or random helper chats.
Why scam texts feel urgent on a phone
Text scams work because phones are fast, small, and personal. A short message can arrive while you are driving, working, half-awake, or waiting for a real package. The link may be shortened, the sender may look unfamiliar, and the amount may be tiny enough to feel harmless.
That is why the safest rule is simple: do not use the text itself as proof. If the message says a package is stuck, open the shopping account or carrier site yourself. If it says a bank account is locked, open the bank app yourself. If it says a toll is unpaid, search for the state toll agency yourself.
Clicking is not the same as submitting information
A common fear is that one tap on a text link means the phone was hacked. A link can be risky, and some links can lead to malware or unwanted downloads, but most scam texts are trying to push you into the next action: entering information, approving a prompt, installing something, calling a number, or paying.
After a click, slow down and separate what happened. Did the page load? Did it ask for a login, code, card number, SSN, address, or small fee? Did your phone ask to install an app, profile, file, or browser permission? Did you submit the form or only close it?
Fake delivery, toll, and bank text patterns
The details change, but smishing texts often use the same pressure points. They put a familiar task on your phone and make the fastest action look like tapping the link.
Common smishing patterns
Text pattern
What it usually asks for
How to check outside the text
Package could not be delivered
Address update, redelivery fee, card details, or personal information
Open the retailer, carrier, or USPS site yourself
Unpaid toll or traffic fee
Small payment, card number, bank login, or driver's license details
Use the state toll agency's real website or known phone number
Bank alert or card blocked
Login, one-time code, card details, or callback to a fake fraud team
Open the bank app or call the number on the card
Account locked or will close
Password, code, email login, Apple ID, Google account, or Microsoft account
Open the account app or website directly
Payment failed or invoice problem
Card number, payment app login, or call to dispute a fake charge
Check the real account history before responding
Verification code request
A code that may approve a login, reset, new device, or payment
Do not share the code; review the real account
These are patterns, not exact scripts. A real-looking logo or familiar company name does not make the text safe.
If the text asked for a code
A one-time code is not just a random number. It can approve a login, password reset, new device, account recovery change, phone-number transfer, or payment. If someone texts you asking for a code, treat the code as access to whatever service sent it.
Code or password checks
Use this if the text asked for a verification code, login code, password reset code, Apple ID, Google password, Microsoft password, bank login, or payment app code.
Stop sharing codes
Do not send another code, screenshot, password, or reset link to anyone in the text thread.
Use the real app or website
Open the account yourself and review sign-ins, recent devices, recovery email and phone, and security alerts.
Change exposed passwords
If you entered a password from the text link, change it and change it anywhere else you reused it.
Contact the provider when access may have changed
Use official support if the account shows unknown sessions, changed recovery details, payments, or password-reset activity.
If the code came from your bank, phone carrier, email, Apple, Google, Microsoft, or a payment app, prioritize that account first.
If the text asked for payment or personal information
A small fee can be the bait. Delivery and toll smishing often ask for a few cents or a few dollars because the payment feels too small to question. The card, bank, address, date of birth, phone number, or SSN entered on that page can be more valuable than the fee itself.
Card number: contact the issuer about replacement, pending charges, disputes, and monitoring.
Bank login or account details: contact the bank quickly using the official app or known phone number.
Payment app login or transfer: use the official app or support site and save transaction details.
SSN, date of birth, ID image, or tax information: use IdentityTheft.gov when identity theft or misuse applies.
Name, address, email, and phone only: expect more targeted texts, calls, or emails, and be careful with follow-up messages.
If the link opened something on your phone
For iPhone and Android, the most useful question is not only whether you tapped. It is whether the text led to an install, download, profile, permission, login, or payment. A blank page or closed browser tab is different from approving an app install or entering account details.
Page did not load: close it, avoid reopening it, and report the text if useful.
Page loaded but you entered nothing: check for downloads, prompts, redirects, or permission requests.
App install prompt: do not install it; remove unknown apps if you already did.
Configuration profile or calendar/profile prompt: do not approve it; remove unknown profiles or calendar subscriptions if added.
File download: do not open it again; delete it if you know it came from the text and run trusted device checks.
Phone acting different: look for unknown apps, profiles, browser changes, account alerts, and payment activity before assuming the worst.
Should you reply STOP?
Reply STOP only when the sender is a service you already know and trust, such as a business or organization you signed up with. If the text is from an unknown sender, looks like a scam, or asks for money or account access, replying can confirm that your number is active.
For suspicious texts, use the phone's report junk or spam option, block the sender, or forward the message to 7726 when applicable. If you already replied, stop the conversation and watch for follow-up texts, calls, or messages that build on what you said.
What not to do next
Do not tap the same link again to test it.
Do not call the number in the text.
Do not share one-time codes, password reset links, or screenshots of codes.
Do not enter card, bank, or SSN details from a text link.
Do not install an app, profile, file, or permission because a text says it is required.
Do not reply with private information or keep the conversation going.
Do not pay a recovery service that promises to undo the scam.
What to save before reporting
You do not need to keep the text forever, but save enough detail before deleting it.
The message
Screenshot the text, including the sender number or short code and the date/time.
The link
Save the visible URL if you can do so without tapping it again.
What happened
Write down whether you clicked, replied, called, typed, submitted, paid, downloaded, or approved a prompt.
Payment or account evidence
Keep receipts, transaction IDs, account alerts, bank notices, card charges, and screenshots of any fake page.
Phone or carrier details
Note whether this came through SMS, iMessage, RCS, a short code, an email-to-text sender, or a group text.
Keep full card numbers, full SSNs, passwords, and private account screenshots out of public posts or random helper chats.
Where to report scam texts
Reporting is still useful if you did not lose money. It helps carriers, messaging platforms, companies, and agencies identify scam campaigns.
Forward unwanted scam texts to 7726, which spells SPAM, when your carrier supports it.
Use the report junk or spam option in your messaging app when available.
Report consumer fraud to the FTC at ReportFraud.ftc.gov.
Report internet-enabled crime, toll smishing, major losses, or account compromise to IC3.gov.
For USPS-style package texts, USPIS asks for the message body, screenshot, sender number, date, and details about whether you clicked, lost money, or shared information.
Report unwanted calls or texts to the FCC Consumer Complaint Center when appropriate.
Contact the bank, card issuer, payment app, carrier, platform, or impersonated organization through official channels when their account or payment system was involved.
Contact work or school IT if a managed account, phone, or work-related login was involved.
When a scam text becomes a broader issue
A smishing page should answer the text-message problem first. After that, the issue may become account recovery, payment fraud, identity risk, device cleanup, or a platform impersonation problem. For this launch version, use the official provider or agency that matches what was exposed.
Account issue: password, code, email, Apple ID, Google account, Microsoft account, bank login, or payment app login.
Payment issue: card, debit, bank transfer, payment app, gift card, or crypto payment.
Identity issue: SSN, date of birth, tax information, ID image, or full personal profile.
Phishing recognition and reporting across text, email, direct message, and phone channels.
FAQ
Is smishing the same as phishing?
Smishing is a text-message version of phishing. Phishing is the broader category. Smishing focuses on SMS, iMessage, RCS, short links, replies, phone prompts, carrier reporting, and mobile behavior.
What if I clicked a scam text link but entered nothing?
Close the page and do not reopen the link. Check whether anything downloaded, whether an app/profile/permission prompt appeared, and whether the page asked for login, payment, code, or identity details. A click alone is different from submitting information.
Should I reply STOP to a suspicious text?
Only reply STOP to a sender you already know and trust. For unknown or suspicious texts, use report junk, block, or 7726 instead. Replying can confirm the number is active.
Can a scam text link hack my iPhone or Android?
Do not assume the phone is hacked from one tap. Look for the next event: a download, app install, profile, permission, login, payment, account alert, or changed settings. If those happened, check the device and affected accounts more closely.
What if the text asked for a small delivery or toll fee?
Treat the fee as a way to collect card, bank, address, or identity details. Check the real delivery, retailer, USPS, or toll account outside the text. If you entered payment details, contact the provider quickly.
What if I entered my card number from a text link?
Contact the card issuer using the number on the card, statement, official app, or official website. Ask about replacement, pending charges, disputes, recurring charges, and monitoring.
How do I report a scam text?
Use your messaging app's report junk or spam option, forward the text to 7726 when supported, report consumer fraud to ReportFraud.ftc.gov, and use IC3.gov when internet-enabled crime, account compromise, or loss is involved.
What does forwarding to 7726 do?
Forwarding a scam text to 7726, which spells SPAM, sends the message to your wireless provider so it can help identify and block similar messages. It does not replace reporting fraud, payment loss, identity exposure, or account compromise to the relevant official channel.