What Is Smishing? Tips to Protect Yourself

You get a text. It says there’s a problem with your bank account or vehicle registration. You want to deal with it right now, and that’s the point: Smishing texts are built to make you act before you think.

What is smishing?

Smishing is a scam that comes through text messages. The word combines short message service (SMS) and phishing. Phishing is when someone pretends to be a company, agency, or authority you trust so that you hand over information or money.

People reported losing $3.5 billion to imposter scams in 2025, according to the FTC. That includes scams that start with a text, an email, a call, or a social media message.

How smishing works

A scammer sends a text that looks like it’s from a trustworthy source, such as your bank, a delivery company, a toll agency, or your state DMV. The message usually does one of three things: it asks you to click a link, call a phone number, or reply with personal details.

If you click on the link, you could land on a fake website built to steal your login credentials, credit card number, or both. Some links can also download malware or spyware to your phone. If you call the number, a “rep” may try to talk you into giving them information or money.

Common smishing tactics

Here are strategies fraudsters use to make smishing more effective:

• Urgency — lines like “Act now or your account will be closed today” push you to act before you check.
• Impersonation — fraudsters pose as your bank, a toll agency, a delivery company, or another entity you trust.
• Fake fraud alerts — a text says a charge looks suspicious and asks you to reply or call to fix it.
• Small asks — sometimes, smishers ask you to do something small, like pay a few bucks to settle a toll.
• Wrong-number texts — a friendly message to the “wrong” person gets you chatting, and the scam comes later.

Sometimes, smishers will combine these tactics. For example, they may impersonate a trusted agency and create a sense of urgency by telling you your license will be suspended by the end of the week if you don’t pay your bill.

Read more >> How to Protect Yourself When Banking Online

Examples of smishing texts

These four are made up, but the patterns are real. Each one leans on a different tactic: urgency, a small fee that feels too trivial to question, a bill you can’t easily check, or a friendly opener that asks for nothing at all.

That last one is the trickiest to catch. Real messages can look like all of these, and a convincing scam won’t have the tells laid out next to it.

How to spot a smishing attempt

• You weren’t expecting the message.
• The message rushes you to act without thinking.
• The message includes an unknown link.
• The message asks you to provide your password, PIN, debit card details, or other sensitive info.
• The phone number or sender info looks off.
• The wording is clumsy or riddled with typos.

When in doubt, confirm the information through a legitimate source. For example, if the sender is claiming to represent a delivery service or the USPS, contact the company using a phone number or website you already trust, like the number on the back of your card or the company’s official app. Don’t use anything from the text.

How to protect yourself from smishing

If you think you’re being smished, use these tips

• Don’t tap links or call numbers in a suspicious text.
• Never share personal or financial info by text.
• Slow down and assess the message to break out of the urgency loop.
• Don’t reply, even to say STOP.
• Turn on spam filtering in your phone’s message settings, and check whether your carrier offers free spam blocking.
• Keep your phone updated with the latest security fixes.
• Turn on two-factor authentication for important accounts.

Read more >> How to Handle Fraudulent Charges on Your Account

‍Forward it to 7726, then delete it. That shortcode spells SPAM on a keypad, and it works on every major U.S. carrier. Forwarding sends them the sender’s number so they can block it for everyone, not just you. It’s free and doesn’t count against your texts.

Then delete the message. Don’t reply — not even “STOP” or “wrong number.” Any response confirms your number is live, which makes it worth more to whoever’s selling it.

What to do if you responded to a smishing text

• If you entered a password, change it on that account and anywhere else you use it.
• If you shared card or bank details, call your bank using the number on the back of your card, and ask about locking the card or blocking transfers.
• If you shared your Social Security number, freeze your credit with Equifax, Experian, and TransUnion. It’s free and stops new accounts from being opened in your name.
• Report it. Submit a report to the FTC at ReportFraud.ftc.gov.
• Check your credit reports. Order your reports for free each week at AnnualCreditReport.com. If you see new or suspicious accounts you don’t recognize, dispute them with the bureaus reporting them.

Read more >> How to Report Identity Theft

Bottom line

If you find an account on your report that you didn’t open, that’s inaccurate information, and you can dispute it for free with each credit bureau. Kikoff’s AI Credit Disputes helps you dispute errors on your credit report, generating personalized letters and tracking your report through the bureau’s response in a few taps. And it’s free for all Kikoff users.