"Smishing" is a scam text message — phishing by SMS. The FBI's Internet Crime Complaint Center reports adults aged 60+ lost $3.4 billion to internet-enabled crime in 2023, and smishing is now the fastest-growing piece of it. The texts copy real companies so well that even experienced users tap before thinking. The five tells below will catch nearly all of them.

What is a smishing text?

A smishing text impersonates a company or government agency you trust — your bank, the IRS, USPS, Amazon — and asks you to click a link, call a number, or "verify" personal information. The goal is to harvest your password, your card number, or your one-time login code.

Real companies almost never resolve account problems by text. When in doubt, do not reply, do not tap the link, and call the company using the number printed on the back of your card or on an official statement.

The five tells that catch nearly every scam text

1. The link is not the company's real domain. A USPS text linking to usps-track-info.com or usps.com.delivery-update.help is fake. USPS uses usps.com only.
2. It creates urgency. "Act within 24 hours," "your account will be locked," "final notice." Real companies give you weeks, not hours.
3. The sender is an email address or an odd long number. Real companies send from short codes (5–6 digits) or their own business number you can verify on their website.
4. It asks for something the company already has. Your bank does not need you to "reconfirm" your card number. The IRS will not text you at all.
5. The greeting is generic. "Dear Customer" or no greeting at all. Real companies almost always use your name or the last four digits of your account.

Real examples from 2026

USPS package text: "USPS: Your package cannot be delivered due to incomplete address. Update here: usps-redelivery.help/x" — Tell #1 (fake domain), Tell #2 (urgency).

Bank fraud alert: "Wells Fargo Alert: Did you authorize a $487 charge at Walmart? Reply YES or NO." — Replying NO triggers a phone call from "fraud prevention" that asks for your debit card number. Real Wells Fargo fraud alerts never ask you to give your card number over the phone.

Grandparent text: "Hi Grandma it's me, I lost my phone, this is my new number. Don't tell mom and dad — I need help." This is not technically smishing (no link) but uses the same emotional urgency. The fix: call the grandchild on their known number before responding.

What to do if you tapped the link

Don't panic. Tapping a link alone usually does not compromise an account. The damage happens when you enter information on the page that opens. If you only tapped:

• Close the page immediately
• Do not enter any information
• Delete the text

If you entered a password or card number:

• Change the password for that account immediately from a trusted device
• Call the real company using the number on the back of the card
• If you gave card information, ask for a new card number
• Place a free fraud alert with one of the three credit bureaus (Equifax, Experian, or TransUnion — they share it with the others)

How to report it

Reporting takes 60 seconds and genuinely helps. In the Messages app, press and hold the suspicious text, tap More, then forward the text to 7726 (which spells SPAM). Your carrier uses these reports to block the sender's number across the network.

You can also report at reportfraud.ftc.gov and, for financial scams, at ic3.gov. For more day-to-day scam protection settings, see our guide on iPhone setup for seniors, which walks through Silence Unknown Callers and other built-in protections.