Smishing (SMS phishing)
Smishing is phishing delivered through SMS or messaging apps. Rather than email, the scammer sends a text posing as a delivery service, bank, government agency, or well-known company, usually with a link to a fake site or a number to call. Texts feel personal and get read in a hurry, and a small screen hides the full web address, so people often tap the link before thinking it through.
Check a suspicious message now
Example
A text says a parcel couldn't be delivered and asks you to pay a small 'redelivery fee' through a link. The page looks like a courier's site but collects your card details and address instead of arranging any delivery.
How to recognize it
- An unexpected text about a package, toll, fine, or account problem
- A shortened or odd-looking link that doesn't match the real company
- A small fee or 'verification' demanded to fix an urgent problem
- A sender that's a random mobile number rather than an official short code
How Hunch flags it
Hunch focuses on signal categories like urgency in the text, links pointing to lookalike or unrelated domains, and requests for payment or personal details bundled into a short message.
FAQ
What does smishing stand for?
It's a blend of 'SMS' and 'phishing', phishing attacks delivered through text messages rather than email.
Should I reply STOP to a smishing text?
No. Replying confirms your number is active. Just delete the message and, if it impersonates a company, report it through their official channel.
Why do delivery and toll texts work so well?
Almost everyone is expecting a package or has driven a toll road at some point, so the message feels plausible, the small fee lowers your guard, and the urgent tone pushes you to act before checking with the real company.