How to identify a phishing or smishing SMS

The specific content and delivery patterns that separate a fraudulent text message from a real one.

By AlertaSpam Security Team. Published August 7, 2026

Look at the pretext first: unexpected parcel delivery fees, a 'held' package needing customs payment, a prize you didn't enter to win, or a bank alert about a transaction you don't recognize are among the most common smishing openers.

The message usually contains a shortened or unfamiliar link, arrives with no personalization (no name, no order number that matches a real purchase), and creates time pressure — 'respond within 24 hours' or 'your account will be locked today'.

Check the sender against a previous, genuine message from the same organization if you have one; a sender name alone is not reliable, since SMS Sender IDs can be spoofed by a third party (see our guide on SMS Sender IDs).

Never tap the link to 'check if it's real' — look up the linked domain on AlertaSpam instead, and if the message claims to be from a company you deal with, contact them through their official app or website, not through anything in the text.