untrappable

Smishing: what it is, with 6 real examples

Editorially reviewed · Last updated July 26, 2026

Yes — this is a scam. Smishing is phishing that arrives by text — a familiar name, a small urgent problem, and a link that isn't the real site.

Text Message · Today 9:18 AM
from +1 (555) 013-8842
State Toll Service: our records show an outstanding toll of $12.51. To avoid a late fee of $50.00, settle your balance today: stateturnpike-tollpay.info/settle
The Text message, as received
Example 2 · USPS “package on hold”
Text Message · Today 11:42 AM
from +1 (555) 014-2025
USPS: Your package is on hold. We couldn't deliver it due to an incomplete address. Confirm your details within 12 hours or it will be returned: usps-trackpkg.info/track
Example 3 · Chase “unauthorized charge”
Text Message · Today 8:42 AM
from +1 (555) 012-7788
Chase Bank Alert: A charge of $612.00 to AMAZON was approved on your card. If you did NOT authorize this, verify now to stop it: chase-secure-alerts.info/verify
Example 4 · Venmo “pending payment”
Text Message · Today 8:41 AM
from +1 (555) 014-2090
Venmo: A payment of $499.00 to an unknown recipient is pending. If this wasn't you, cancel it now: venmo-secure.info/cancel
Example 5 · Cash App “cancel this payment”
Text Message · Today 11:42 AM
from +1 (555) 018-2025
Cash App: A $750.00 payment to an unknown recipient is pending. If you didn't authorize this, cancel it now: cashapp-secure.info/cancel
Example 6 · Netflix “payment declined”
Text Message · Today 6:17 PM
from +1 (213) 555-0186
Netflix: Your payment was declined and your membership will be cancelled tonight. Update your billing to keep watching: netflix-billing-update.com/renew

Other versions you might get: The costume changes — a delivery company, your bank, a toll authority, a payment app, a streaming service, even the tax office — but the shape underneath is always the same: a name you trust, a small urgent problem, a deadline, and a link that isn't the real address.

Word-for-word versions going around

Each of these is a real text, quoted exactly as people received it. If yours matches one — even loosely — it’s the same scam.

  • “(State Toll Service Name): We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit https://myturnpiketollservices.com to settle your balance.”
    Documented by FBI Internet Crime Complaint Center (IC3) · April 2024

What to do right now

  1. Don't tap the link, and don't reply — not even “STOP”. A reply tells the sender the number is live.
  2. Check the account yourself. Open the company's app or type its real address into your browser. The FTC's rule is simple: legitimate companies won't ask for information about your account by text.
  3. Forward it to 7726 (SPAM). It's free on every major carrier, and it feeds the sender's number into carrier-level blocking.
  4. Report it. File at reportfraud.ftc.gov. If it impersonated USPS, email spam@uspis.gov. If you lost money, add a complaint at ic3.gov with the sender's number and the website from the text.
  5. If you already tapped and entered something: change that password, turn on two-factor authentication, and call your bank or card issuer to dispute any charge you don't recognize. Then block the number and delete the message.

How to make sure it never bites you

If you tapped the link and closed it without typing anything, you are very likely fine — the harm starts when details go in, not when a page loads. If you did enter a password or a card number, the steps above close it down quickly. And getting the text doesn't mean you were singled out: these go out in bulk blasts to lists of numbers, which is why the same message reaches people who ordered nothing and drive no toll roads. To cut how many arrive at all, see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

What is smishing?
Smishing is phishing carried out by text message. The U.S. Postal Inspection Service defines it as “a form of phishing that involves a text message or phone number,” where victims receive a deceptive text “intended to lure the recipient into providing their personal or financial information.” The scammers disguise themselves as a government agency, a bank, or a company you use, to lend legitimacy to the claim. The name is a blend of SMS and phishing.
How does a smishing attack work?
A message arrives claiming a small, urgent problem — a package on hold, an unpaid toll, a charge you didn't make — and offers a link to fix it. The link goes to a look-alike site that copies the real one. Whatever you type there (a login, a card number, an address) goes to the sender. The FTC notes some links instead install malware that takes your information without you noticing. There's no package, no toll, and no charge; the message is the whole attack.
How can I tell a smishing text from a real one?
Three checks settle almost every case. Did you ask for this? Real alerts are ones you signed up for. Is there a link? Many services never text links at all — USPS states its genuine tracking texts will NOT contain one. Who sent it? Real services text from 5-digit short codes, not 10-digit mobile numbers or overseas ones. Then apply the FTC's rule: legitimate companies won't ask for information about your account by text. When in doubt, don't use the text — open the app or type the address yourself.
What should I do if I clicked a link in a smishing text?
Don't panic. Loading the page alone is usually harmless — the risk begins if you entered a password, card number, or personal details, or downloaded anything. If you did, change that password now, turn on two-factor authentication, and call your bank or card issuer to dispute unfamiliar charges. The FBI's IC3 advises exactly this: secure your accounts and dispute any charges you don't recognize. If you typed nothing, you're very likely fine.
How do I report a smishing text?
There are three routes and they take about a minute. Forward the message to 7726 (SPAM) — the FCC confirms most carriers use this to spot and block similar messages. Report it as junk in your messaging app. And file with the FTC at reportfraud.ftc.gov. For USPS impersonation, email spam@uspis.gov; if money was lost, file at ic3.gov and include the originating phone number and the website listed in the text.
Why am I getting so many scam texts?
Because they're sent in bulk to lists of numbers, not chosen for you. Your number reaches those lists the ordinary ways — data breaches, apps that resold your details, people-search sites that republish them. Receiving one doesn't mean you've been hacked. FCC rules ban autodialed texts to a mobile phone without your prior consent, and they apply whether or not your number is on the National Do Not Call Registry — but the senders breaking those rules aren't checking. Forwarding to 7726 and reporting is what gets numbers and phishing domains shut down.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.