Smishing and vishing
Phishing by text message and phone call. Fake delivery texts, "your bank's fraud team" and toll-road scams explained, plus how to verify any caller safely.
Two old tricks on new channels
Smishing is phishing by SMS or a messaging app. Vishing is voice phishing: a phone call, a voicemail or a robocall. They work because people trust their phones more than their inbox, links in texts are hard to inspect, and a live voice creates pressure that an email cannot.
The most common text scams
- Package delivery: "Your parcel is on hold, pay a small redelivery fee." The tiny fee is a way to collect your full card details.
- Unpaid toll or parking: "Pay your outstanding toll today to avoid a penalty." These texts spread widely across US states in 2024 and 2025, and the FBI issued public warnings about them.
- Bank alert: "Did you attempt a purchase of 849.99? Reply YES or NO." Replying confirms your number is active and often triggers a call from a fake fraud team.
- Wrong number, then friendship: a "mistaken" message that turns into weeks of friendly chat and ends with an investment pitch, often crypto.
- Verification codes: "I sent you a code by mistake, can you forward it?" That code is the key to your account.
- Job offers: easy remote work paying for "likes" or "reviews", which later asks you to deposit money to unlock earnings.
How scam calls work
Caller ID can be faked, so a call can display your bank's real number. The caller often already knows your name, address and part of your card number from old data breaches, which makes them sound legitimate. Common scripts:
| Script | What they want |
|---|---|
| "Your bank's fraud department" | Your one-time code, or a transfer to a "safe account" |
| "Tech support found a virus" | Remote access to your computer, then payment |
| "A government agency: you owe a fine" | Gift cards, wire transfer or crypto |
| "A relative in trouble" | Urgent money, often by courier or transfer |
| "Your account will be suspended" | Your login details |
Voice-cloning tools can now imitate a familiar voice from a short sample. See deepfake and AI scams.
Your bank will never ask you to read out a one-time code, move money to a "safe account" or give your full PIN or online banking password. Anyone who asks for those is a criminal, whatever number they call from.
The verification habit
- Hang up or stop replying. You lose nothing by ending the conversation.
- Find the number yourself on the back of your card, in the official app or on a statement.
- Call back on that number, ideally after a few minutes, because some scammers keep the line open.
- For family emergencies, agree a family code word in advance and call the person directly.
- Never install an app or give remote access because a caller asked.
Protect your phone number
- Never forward or read out verification codes to anyone.
- Ask your carrier for a port-out PIN or number lock, which defends against SIM swapping.
- Turn on spam filtering ("Silence Unknown Callers" on iPhone, "Caller ID and spam" on Android phones) if missing a few legitimate calls is acceptable to you.
- Do not tap links in texts about money or deliveries. Open the carrier's, bank's or store's app instead.
Report it
In the US and UK forward scam texts to 7726. In the US also report to ReportFraud.ftc.gov. Registering on the National Do Not Call Registry will not stop criminals, but it makes illegal sales calls easier to recognize: legitimate companies must respect it.
