What is smishing?

Smishing is a scam text message designed to trick you into clicking a malicious link, handing over personal details, or paying money to a fraudster. The word blends "SMS" and "phishing," and it's now one of the most common ways UK mobile users are targeted, alongside the scam calls we cover in our guide to scam and fraud protection for mobile users.

How smishing works

A smishing text usually pretends to be from someone you'd trust without thinking twice, your bank, HMRC, Royal Mail, DVLA, or a delivery courier. The message creates urgency ("your parcel couldn't be delivered," "your account has been suspended") and includes a link. That link leads to a fake website built to steal your login details or card information, or in some cases installs malware on your phone.

Fraudsters can also spoof the sender ID, so the text appears in the same message thread as genuine texts from your real bank, making it harder to spot. Ofcom estimates around 100 million suspicious messages were reported to UK networks in the year to April 2025, affecting roughly half of all mobile users.

Common smishing examples

A few patterns show up again and again, a missed parcel delivery needing a small "redelivery fee," a bank fraud alert asking you to confirm your details by tapping a link, an HMRC message about a tax rebate or an unpaid fine, and a text claiming your mobile account is about to be suspended unless you log in via a supplied link.

How to spot a smishing text

Genuine organisations won't ask you to click a link to confirm a payment or login on a text message you weren't expecting. Look out for a sense of urgency, generic greetings instead of your name, links that don't match the organisation's real website when you hover over or long-press them, and requests for one-time passcodes, which no legitimate bank or network will ever ask for by text.

What to do if you receive one

Don't click the link. Forward the message free to 7726, which reports it directly to your network so they can investigate and block the sender. Delete the text once you've reported it, and if you've already clicked a link or shared details, contact your bank immediately and report it to Action Fraud.

How UK networks are tackling smishing

Mobile operators now filter and block large volumes of scam texts before they reach customers, and new Ofcom rules introduced in 2026 require networks to cap bulk messaging from pay-as-you-go SIMs and verify business senders before their texts go out. For a full breakdown of what EE, O2, Vodafone and Three are each doing to fight scam calls and texts, and where the gaps still are, read our guide to scam and fraud protection for mobile users.