By receive-sms.app · Based on how this directory collects and displays public SMS.
Smishing is phishing carried out by text message. A scammer sends an SMS that looks like it comes from a bank, courier, tax office or well-known company, and tries to get you to click a link, call a number or hand over a code. Text messages feel personal and urgent, which is why they work so well. This guide describes the most common patterns, the warning signs that give them away, a special case you will see in public SMS inboxes, and a few simple rules that protect you in nearly every situation.
Why scammers use text messages
SMS is cheap to send in bulk, reaches people who ignore email, and arrives in the same thread as messages from friends and family. Shortened links hide the real destination, and a small screen makes it harder to inspect a web address. Scammers also exploit urgency: a parcel on hold, a locked bank account, a missed payment. The goal is to make you act before you think. Most smishing messages share that pattern, a plausible sender, a problem you must fix quickly, and a link or number that offers to fix it.
From our team · RevalVIN
Buying a used car?
RevalVIN gives a free VIN preview and pay-per-check history reports: mileage, stolen status, recalls and more. No subscription.
Fake delivery messages
A very common version claims that a parcel could not be delivered and asks you to pay a small fee or confirm an address by clicking a link. The page then asks for card details or a login. Real couriers typically refer to a tracking number you already have, and do not ask for payment through a link in an unexpected text. If you are not waiting for a parcel, ignore the message. If you are, go to the courier's official website or app by typing the address yourself and enter the tracking number there.
Fake bank and payment alerts
Messages claiming unusual activity on your account, a blocked card or a failed payment are another staple. The link leads to a copy of your bank's login page that captures your credentials and often the one-time code as well. Banks do send genuine security texts, but they do not need you to log in through a link inside a message. If you are worried, close the message, open your banking app or type the address yourself, or call the number printed on your card, never the number in the text.
Other common bait
Expect messages about tax refunds, unpaid fines, prize draws, job offers that pay a lot for little work, parcels from a service you never used, and wrong-number texts that invite a friendly chat. Some are the start of a longer fraud, such as an investment scheme or a romance scam. Others claim a family member has a new number and needs money. Verify by contacting the person on the number you already have. A message that begins with a stranger's friendliness and ends with a request for money or a code is a warning sign.
Warning signs worth checking
Look for urgency or threats, a generic greeting instead of your name, an unexpected request for money, a code or a login, and a link that uses a shortener or a domain that is close to a real one but not the same. Spelling and grammar mistakes are common, although better scams avoid them. The sender can also be faked, so a message that appears inside a thread with a real sender is not proof of authenticity. The safest test is whether the message asks you to click, log in or pay.
A special case: credential bait in public inboxes
Anyone who browses public SMS inboxes will notice messages such as a line of text giving a username, a password and a large balance, for example a crypto wallet with a figure like 2,341,076. These are scams. They are sent to public numbers on purpose, because the sender knows people will read them. The idea is that you will log in to the named site, see a large balance, and then be asked to pay a fee, a tax or a deposit to withdraw it. The money does not exist, and the login page is a trap.
Why the wallet scam never pays out
The site that the message points to is run by the scammers, so the balance you see is just a number on their page. When you try to withdraw, you are told to pay an unlock, verification or network fee in real cryptocurrency, and each payment is followed by a new demand. Nothing is ever released. Another variant asks you to import a wallet recovery phrase, which gives them complete control of your own funds. Never enter a recovery phrase or private key anywhere, for any reason.
Never log into anything from a text
The simplest rule that defeats almost every smishing attempt is this: do not log in to an account using a link from a text message. Do not use credentials someone else sends you either. Instead, open the official app or type the site's address yourself. This also means that you should not follow links, scan QR codes, or call numbers found in messages that arrive on a public number. Read them for information if you must, but treat every one as untrusted.
What to do if you clicked or replied
If you only clicked a link and entered nothing, close the page, and run a security scan if your phone behaves strangely. If you entered a password, change it at once on the real site and on any other site where you reused it, and turn on two-factor authentication. If you gave card details, call your bank using the number on your card and ask to block the card. If you shared a code, treat the account as compromised. If you sent cryptocurrency, report it to your local authorities, though recovery is rarely possible.
Reporting and staying alert
Many countries have a way to report scam texts, and some mobile networks accept forwarded messages to a short code or address for this purpose. Check your carrier's website for the current method. Reporting helps block the sender for others. Keep your phone and apps updated, use a password manager that will not fill a password on a fake domain, and tell relatives, especially older ones, about these patterns. A pause of thirty seconds to ask whether the message makes sense is the best defence there is.