What is smishing?

Smishing is phishing sent through a text message from a criminal pretending to be a delivery company, bank or another trusted contact. The message may lead to a fake website that asks for your details. It can also try to make you install harmful software or send money. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A text borrows a familiar name or an urgent story. 12
  2. A link takes you to a fake form or a harmful download. 12
  3. The criminal tries to use what you type, install or pay. 12

Real UK example

The NCSC published examples of missed-parcel texts targeting UK phone users. The links led to malware disguised as parcel-tracking apps.

Its guidance names FluBot as one example. This was not simply a failed delivery: the supposed tracking app could steal information and send further scam texts. 2

Warning signs

  • A parcel fee you were not expecting. 12
  • A security alert that asks you to sign in through a text link. 12
  • A demand to install an app from the message. 12
  • A request that feels unusual, even inside a familiar message thread. 12

What to do now

  1. Do not reply, pay through the link or install the suggested app. 12
  2. Check the claim using the organisation’s genuine app or website. 12
  3. Forward the text to 7726. If you installed an app, follow the NCSC’s linked malware guidance. 1234

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 567
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 68
  • If someone is in danger, call 999. 8

How to protect yourself

  • Track deliveries through the courier’s genuine app or website. 12
  • Keep your phone and apps updated. 12
  • Treat the sender name as a clue, not proof. 12

Frequently asked questions

What is the difference between phishing and smishing?

Smishing is the text-message version of phishing. The aim is still to trick you into an unsafe action. 1

Can a scam text appear in a genuine message thread?

Yes. Report Fraud says criminals can spoof a sender so a text appears beside genuine messages. 1

Where do I report a scam text in the UK?

Forward the text to 7726. If money has gone, contact your bank as well. Reporting a text is not a bank claim. 35

Matching kit

After a Scam: What to Do First · £7 · Digital download.

A printable UK checklist for the money, account and reporting steps. It is general information, not a recovery service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. Report Fraud, Smishing - Report Fraud. Accessed 7 November 2026 (Europe/London).
  2. NCSC, Scam 'missed parcel' SMS messages: advice on avoiding malware | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  3. GOV.UK, Avoid and report internet scams and phishing: Report internet scams and phishing - GOV.UK. Accessed 7 November 2026 (Europe/London).
  4. Report Fraud, How to report suspicious messages, calls and websites - Report Fraud. Accessed 7 November 2026 (Europe/London).
  5. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  6. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  7. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  8. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).