A text arrives claiming to be from the USPS, saying a package couldn’t be delivered because of an address issue, with a link to fix it. Or it’s “your bank” flagging a suspicious charge. Or a toll agency saying you have an unpaid balance. These messages, known as smishing (phishing over SMS), have become the highest-volume scam text people receive, and they work because a text message carries an unearned assumption of legitimacy that email lost years ago.
Why texts get more trust than they deserve
Most people have learned to be suspicious of email links after years of phishing awareness. That skepticism hasn’t transferred to text messages at the same rate, even though a text is exactly as easy to fake as an email. Caller ID and sender names on SMS can be spoofed the same way email “from” addresses can.
The two-second check that catches almost all of them
Look at the link itself, not the message around it. Legitimate delivery, banking, and toll notifications link to the company’s actual domain: usps.com, not usps-delivery-update.com or a shortened link. Scam texts almost always use a domain that’s close to the real one but not it, or a generic link shortener that hides the destination entirely. If you can’t tell where a link actually goes by looking at it, don’t tap it.
The second signal: what it’s asking you to do
Real delivery and billing notifications tell you to check your account by opening the official app or going to the site directly. They essentially never ask you to “confirm” personal information, payment details, or your address by clicking a link in the text itself. Any message asking you to enter payment information to release a package, or log in through a linked page to fix an account issue, is following the scam script rather than a real company’s process.
What to do instead
Don’t tap the link. Open the official app or type the company’s known web address into your browser directly, and check the same information there. If a real charge or delivery issue exists, it will show up in your actual account. If nothing shows up, the text was fake, and you can report and delete it.
Reporting it actually helps
Forward smishing texts to 7726 (spells “SPAM” on a keypad), which routes them to your carrier’s fraud team and helps get the sending numbers blocked faster for everyone else receiving the same blast.
The bottom line
Ignore the message and read the link. A domain that’s slightly wrong, or a request to enter information instead of check it yourself, is the tell every single time. That two-second habit closes off the scam completely.