Text-message evidence guide
Smishing: package, bank & toll text scams
A text can borrow the name of a delivery company, bank, or toll agency. The useful question is not whether the message sounds urgent; it is whether its sender, link, and request match a source you can open independently.
Evidence Over Accusation. These are observable signals to verify, not labels for a person or a guarantee about a transaction.
Read the evidence
Signals you can check yourself
Several connected signals may justify a closer look. A single signal rarely tells the whole story.
The visible link does not match the named organization
Press and hold or inspect the destination without opening a payment page. A domain that differs from the organization named in the text is a High Risk signal.
The URL is shortened or redirects elsewhere
Abbreviated links can hide their destination. A redirect chain or unfamiliar domain calls for a Caution pause and an independent check in the official app or website.
Urgency replaces specific account context
“Final notice,” “today only,” and immediate fee language are pressure signals. Compare the claim with a notice inside the account or app you normally use.
The text requests payment or login details
A request to enter card details, a password, or a verification code through a link in an unexpected text is a High Risk signal. Use your saved app or a bookmarked site instead.
The sender details do not line up
A generic phone number, inconsistent spelling, or a claimed delivery that does not match your recent orders can add useful context when viewed with the link and request.
Verify before you send
Make room for a better decision.
- 01
Open the app directly
Check package, bank, or toll status from the app or site you already use instead of starting from the text link.
- 02
Read the domain carefully
Compare every part of the address with the organization’s known domain; small spelling changes and extra words matter.
- 03
Preserve the message
Screenshot the text, sender, link, and any payment request before deleting or reporting it so you can compare details later.
Keep reading