How to Spot a Phishing Text Message (With Real Examples)

If you've gotten a text from "USPS" about a package you didn't order, or from "your bank" warning of suspicious activity, you've been targeted by smishing — phishing by SMS. These messages now outnumber traditional scam emails, and they're designed to make you panic and tap before you think.

Here's how to spot them every time.

The 5 red flags

1. Urgency. "Act in the next 24 hours or your account will be closed." Real companies don't operate this way.

2. A link you don't recognize. Hover or long-press the link without tapping. If the URL isn't your bank's real website, it's fake.

3. Generic greetings. "Dear Customer" instead of your name.

4. A request to confirm personal info. Your bank already has your Social Security number — they will never text asking you to verify it.

5. Misspellings and odd punctuation. "Your acount has been Suspend." Real companies have copy editors.

Real examples we've seen this month

• "USPS: Your package cannot be delivered due to incomplete address. Update here: usps-delivery-info[dot]com"

• "Wells Fargo Alert: A charge of $487.22 was attempted. Reply NO to dispute."

• "Hi Mom, I dropped my phone and this is my new number. Can you help me with something?"

That last one is the "grandparent scam" by text — and it works because it preys on love, not fear.

What to do when one arrives

• Don't tap the link. Even tapping can sometimes load tracking pixels.

• Don't reply — not even "STOP." Replying confirms your number is active.

• Take a screenshot and report it by forwarding to 7726 (spells SPAM). It's free on every U.S. carrier.

• Delete the message.

• If it claimed to be from a company you actually use, open the official app directly or call the number on the back of your card. Never use the number in the text.

A two-second habit that protects you

Before tapping any link in a text, ask: "Did I ask for this?" If the answer is no, you owe the message nothing. Delete and move on.