That text message from Royal Mail, your bank or HMRC might look completely legitimate. It probably isn’t. Smishing, also known as SMS phishing, is one of the fastest-growing forms of cybercrime, using fraudulent text messages to trick people into handing over personal information.
Here’s how to spot a scam text message, avoid becoming a victim, and what to do if you’ve already clicked.
Most people have now heard of phishing – the fraudulent emails designed to steal your personal details or hijack your accounts. Fewer people are familiar with smishing (SMS phishing), which is essentially the same scam delivered by text message. Rather than sending a fraudulent email, criminals send a malicious text message that appears to come from a trusted organisation.
The reason smishing has grown so rapidly is straightforward: it works. We have become conditioned to trust text messages in a way we no longer trust emails. We expect texts to be direct, urgent and real. Fraudsters know this, and they exploit it expertly.
How Smishing Works
A smishing attack follows a well-worn formula. You receive a text message that appears to come from a trusted organisation – your bank, HMRC, Royal Mail, a delivery company, or a government body such as the NHS or DVLA. The message creates a sense of urgency. There is a problem with your delivery. Your account has been suspended. You owe a small customs fee. Your package is waiting. You must act now.
The message contains a link. That link takes you to a website that looks convincingly like the real thing – the correct logo, the right colour scheme, familiar layout. You are asked to enter personal details: your name, address, date of birth, account number, card details, or password. The moment you do, those details are in the hands of criminals.
Some smishing attacks go further. Rather than simply stealing your login details, they attempt to trick you into installing malicious software or exploit security vulnerabilities on your device. If successful, this malware may allow criminals to monitor activity, steal stored passwords or intercept authentication codes.
Common Smishing Examples in the UK
You may well have seen some of these yourself:
Royal Mail and Parcel Delivery Text Scams – Perhaps the most common parcel delivery text scam claims your parcel couldn’t be delivered because a small fee is outstanding. The text directs you to what appears to be the Royal Mail website, but it’s actually a fake Royal Mail text designed to steal your payment details.
Bank Text Scams – Bank text scams often warn of suspicious activity on your account and ask you to verify your details or call a fraudulent number.
HMRC Tax Refund Scams – A text claiming you are owed a tax refund and directing you to a government-lookalike website to claim it. No personal details, no refund; just your information handed to criminals.
NHS / GP Appointment Scams – Messages claiming to be from the NHS asking you to confirm or book an appointment. These often appear particularly convincing because we are accustomed to genuine NHS text messages.
Competition Win Notifications – You have won a prize. Click here to claim. You haven’t won anything.
Why Smishing is So Effective
Several factors make smishing particularly difficult to detect and resist:
Phone numbers are easy to spoof. Criminals can make a text message appear to come from a recognised name or number – even one that appears in an existing conversation thread on your phone. You might see a message that appears to continue a legitimate conversation with your bank, when in fact it has been inserted by a fraudster.
We act on texts more quickly. Research consistently shows that text message scams are more likely to catch people off guard than fraudulent emails because text messages feel more personal and immediate. As a result, we are often less likely to pause and scrutinise them carefully. The combination of a trusted-looking sender and a sense of urgency is designed to override our natural caution.
The links are hard to inspect. Unlike on a desktop computer, it is often much harder to inspect where a link really leads before opening it.
We receive genuine texts from these organisations. Banks, delivery companies and government bodies really do send texts. That familiarity makes the fraudulent versions harder to distinguish.
How to Spot a Smishing Message
No single indicator makes a text message definitively fraudulent, but these warning signs should immediately raise your suspicion:
Urgency. Any message telling you that you must act immediately, within 24 hours, or risk losing access to something, is designed to stop you thinking clearly. Pause.
Unexpected contact. If you were not expecting a text from your bank, HMRC, or a delivery company, treat it with scepticism. Genuine organisations rarely send unsolicited texts asking for personal information or payment.
Links that don’t match. One of the easiest ways to identify a fraudulent SMS is by examining the web address. Criminals often register domains that look almost identical to the genuine org