Text Message (Smishing) Scams

Smishing is phishing by SMS. It has exploded because texts feel personal and urgent, and phones make it harder to inspect links. The message claims a small problem (an unpaid toll, a held package, a suspicious login) that "just takes a minute" to fix. The link leads to a fake site that harvests your card number and login credentials.

The Most Common Smishing Lures:

• Unpaid Toll Notices: Texts impersonating E-ZPass, SunPass, or state DMV agencies claim you owe a few dollars in tolls and threaten late fees. Toll agencies don't collect this way.
• Package Delivery Problems: Fake USPS, FedEx, or UPS texts say a package needs a small "redelivery fee" or an address confirmation.
• Bank Fraud Alerts: "Did you authorize a $500 purchase? Reply NO or call this number." The "fraud department" that answers is the fraud. See Bank Impersonation Scams.
• Wrong-Number Openers: A friendly "Hey, is this Sarah?" text is often the first step of an investment scam. The goal is a conversation, not a correction.
• QR Code Variants ("Quishing"): Malicious QR codes in messages, emails, or even stickers placed over legitimate codes on parking meters lead to the same credential-stealing sites.

Key Red Flags:

• A small, urgent fee. Scammers keep the amount low so paying feels easier than checking.
• Links with odd domains (e.g., a toll agency at a .top, .xyz, or unfamiliar address) or misspelled brand names.
• Texts about accounts, packages, or tolls you weren't expecting.
• Any text asking you to reply, tap a link, or call a number to "verify" personal or payment information.

How to Protect Yourself:

• Don't click, don't reply: Even replying "STOP" confirms your number is live to a scammer.
• Go to the source: Check your toll, delivery, or bank account through the official app or website you already use.
• Report and delete: Forward scam texts to 7726 (SPAM). It's free and helps carriers block the sender.
• If you already clicked: Don't enter anything; if you did, contact your bank, change the exposed passwords, and watch your statements.