How to spot and report fake text message and smishing scams

We’ve all become aware of “phishing”, the use of fake emails, to scam us out of money, but now you could be targeted by fake SMS text message as well. This is called “smishing”.

So, what is smishing, how can you spot it and what should you do if you’ve been targeted?

You receive a text message, commonly from your bank or another service provider such as a mail delivery or utility company, telling you there’s a problem with your account or parcel delivery, issues with a recent payment or some suspicious activity.

The text will contain a link for you to click or a number to call to sort out whatever the problem is. Action Fraud has some examples of scams (Opens in a new window)

If it’s a link, it will direct you to a fake website that often looks very similar to the company’s official website. These pages will harvest your bank login details when you put them in.

If there’s a phone number, it won’t be the real company and the scammer on the end of the line will try to get you to reveal information such as usernames, passwords and PINs.

Fraudsters are increasingly impersonating a wide variety of big-name companies. Sometimes they’ll claim to be from an online account such as PayPal, or a service you subscribe to, such as Netflix. Delivery companies like Evri and Royal Mail have reported big jumps in the use of fake texts. Fake text message scams have also been reported targeting customers of government organisations such as HMRC and the DVLA.

No. Many companies, such as your bank, mail delivery companies or energy or water providers might legitimately contact you through text message.

This is why it’s important to know how certain companies might try to get in touch with you. You can normally select your contact preferences, such as phone call, email or text message, in your profile.

Smishing can be difficult to spot, particularly if it’s from a person or company who would normally contact you by text.

But, like email scams, there are some tell-tale signs. For example, there might be spelling mistakes, or the text might address you as 'Sir' or 'Madam'. Real messages from these companies will usually address you by your name. However, scammers are getting smarter, and your full name and phone number could be available to them on the dark web.

If you’re still not sure, check the phone number it’s been sent from. It might be sent from an overseas number. You could also do a search for it online. If it’s a known fake number there’ll be information on the internet.

If the text is from your bank, you can check the number on the back of your card to see if they match.

Sophisticated scammers can also use something called ‘number spoofing’, where they can fake the phone number texts and calls come from. 

Sometimes a text might arrive, and it might just say the name of the company instead of a number. Scammers can fake this too, so don’t assume texts like that are safe. 

If you’re in doubt, you can ring the number on the back of your card to check if they've been in touch recently. 

The best way to avoid being a victim of smishing is to be wary of any text message you get.

Never click any links in texts. If in doubt, go directly to the website and login as normal. If there really is a problem you’ll have a message on the official company website telling you what you need to do.

If you do click the link, be vigilant. Many scammers have developed very close replicas of genuine websites to fool you. But there’ll be some signs it’s not legitimate, such as odd spelling in the web address, or low-quality graphics.

If you have received what you believe to be a fake text message or smishing scam, then you should report it to the company who allegedly sent you the message. This’ll give them the chance to alert other users to the risks.

Some organisations even have a dedicated email address for you to report potential scams to.

If you’ve been a victim of a smishing scam, then you need to report it to Action Fraud by calling 0300 123 2040, or by using Action Fraud's online form (Opens in a new window)

The most important thing you can do is never click on links in suspicious texts or call the phone number in the message.

But, if you do, never give out personal details under any circumstances.

No legitimate company is going to ask you to reveal personal or security information over the phone. Under no circumstances tell a caller your PIN, password or any other piece of information that could compromise your account.

Another safety tip is to know how certain companies will address you. Legitimate companies will normally address you by your full name as a way of helping you spot fraudulent messages.

Scammers probably won’t know your full name, so will use something generic such as Sir, Madam or valued customer.

It’s also a good idea to keep anti-virus software and operating systems up-to-date. These will help protect you if you do end up on a fake website that’s trying to harvest your information.