The Federal Trade Commission reported that losses to text message scams hit 470 million US dollars in 2024, more than five times the 2020 figure, and the FBI’s Internet Crime Complaint Center logged 193,407 phishing and spoofing complaints in the same year, its most common complaint type, according to HousingWire’s summary of the IC3 report. Text-based phishing, called smishing, works because people read texts quickly and trust their phone more than their inbox.
This guide explains how smishing works, the red flags that give a scam text away, common scam patterns, what to do if you have clicked or replied, and how to report scam messages. It is written for ordinary phone users, and includes a short plan for families and small businesses.
What Smishing Is and Why It Works
Smishing is phishing delivered by SMS, messaging apps, or RCS. Attackers send a short message that claims to come from a bank, delivery company, government agency, or employer and ask you to click a link, call a number, or reply with a code. The message creates urgency so you act before you think. Text messages feel personal, arrive on a device you check constantly, and are shorter than emails, which leaves less room for the clues people use to spot a fake.
Attackers also use AI to write messages that read naturally and to target by language and region. Our post on AI phishing attacks explains how the old advice about poor grammar no longer works, and our overview of how hackers use AI shows how this scales.
The Numbers Behind Text Scams
The scale is large. The FTC said reported losses to text scams reached 470 million US dollars in 2024, more than five times the 2020 figure, and noted that the real total is likely higher because most fraud goes unreported. The FBI’s IC3 recorded 859,531 complaints and 16.6 billion US dollars in total losses in 2024, with phishing and spoofing the most common complaint type at 193,407 reports, according to HousingWire’s summary. Verizon’s 2025 breach report found phishing in 57 percent of social engineering incidents and 85 percent of 4,009 social engineering incidents resulted in confirmed data disclosure, according to Abnormal AI’s summary. In other words, scam texts are a front door for bigger losses.
Eight Red Flags in a Scam Text
| Red Flag | What It Looks Like | What to Do |
|---|---|---|
| Urgency | Your account will be closed in 24 hours | Stop and verify through the official app |
| Unexpected request | A parcel fee, toll charge, or refund you did not expect | Check the company’s website directly |
| Unknown or odd link | Shortened links or look-alike domains | Do not tap; do not preview |
| Mismatched sender | A bank name from a random number | Ignore, and check the bank’s official channels |
| Request for a code | Send me the code you just received | Never share one-time passcodes |
| Payment by gift card or crypto | Pay with vouchers or transfer | Treat as a scam |
| Generic greeting | Dear customer | Be suspicious if details are missing |
| Too good to be true | Prize, job offer, or easy money | Delete and block |
Common Smishing Patterns
The FTC’s data spotlight names five scam types that account for about half of reported text fraud: fake package delivery problems, phony job opportunities known as task scams, fake fraud alerts, bogus toll notices, and wrong-number texts that lead to investment scams. Several patterns recur. Delivery scams claim a parcel is held and ask for a small fee or address update. Bank alert scams say there is suspicious activity and tell you to click a link or call a number. Toll and fine scams claim an unpaid charge. Job and task scams offer easy money for simple online tasks and later ask you to deposit funds. Government and tax scams threaten penalties. Account verification scams pose as a technology or social platform. Wrong-number texts begin a friendly chat that turns into an investment or romance scam. Voice-clone follow-ups may then call, pretending to be a relative, so a family code word helps.
What to Do Before You Click
Pause for ten seconds and ask three questions: was I expecting this, who is it really from, and what happens if I ignore it. If a message claims to be from a company, open its official app or type its web address yourself. If it claims to be from a person you know, call them on a known number. Do not call the number in the text. If a message urges you to act within minutes, treat the urgency itself as a warning sign.
What to Do If You Clicked or Replied
Act quickly but calmly. If you entered a password, change it on the real site and on any other site where you used it, and turn on multi-factor authentication, using our guide to the best password managers to create unique passwords. If you shared card or bank details, call your bank on the number on your card and ask them to block and reissue the card. If you shared a one-time code, tell the service immediately. If you installed an app from a link, remove it and run a security scan. Watch your accounts and credit reports for weeks, and note the time and details for a report.
How to Report Scam Texts
Reporting helps others. In the United States, forward scam texts to 7726 (SPAM), which reports them to your carrier, and report fraud to the FTC at ReportFraud.ftc.gov or to the FBI’s IC3 at ic3.gov. In India, report cyber fraud to the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930. After reporting, delete the text and block the sender. If a scam impersonates your employer, tell your IT or security team so they can warn colleagues. Reports from individuals are one reason scam networks get disrupted.
A Quick Plan for Families and Small Businesses
Families can agree on three rules: never click links in unexpected texts, never share codes, and always confirm money requests by calling the person. Small businesses should train staff to treat texts that claim to be from the boss or a supplier with suspicion, and add a call-back rule for payment changes. Our guides to a small business cybersecurity audit and remote work cybersecurity help organisations build these into policy.
