Smishing Examples: 9 Text Scam Formats to Recognize

Smishing is phishing delivered by text message: a scammer impersonates a trusted organization or person over SMS to steal money, credentials, or personal information. The fastest way to build immunity is to study the formats. Nearly every scam text in circulation is a variation on a small number of proven templates, and once you can name the template, the message loses its power.

This article catalogs nine smishing archetypes that consumer protection agencies, including the FTC, the FBI's Internet Crime Complaint Center (IC3), and the US Postal Inspection Service (USPIS), warn about repeatedly. Each entry includes an illustrative sample. Important: every sample text below is a made-up illustration written for training purposes, not a real quoted message, though each mirrors the structure of scams reported to federal agencies. If you want the definitional background first, start with our glossary entry on what smishing is and how SMS phishing works.

1. The Fake Package Delivery Text

Among the most widespread smishing formats is one that impersonates USPS, or sometimes a private carrier, claiming a package is stuck and a small action is needed.

Illustration: "USPS: Your parcel is on hold due to an incomplete address. Confirm your details within 24 hours to avoid return: [link]"

Red flags: USPS does not send unsolicited texts containing links about package problems. Real USPS tracking texts arrive only if you signed up for them, and they do not ask you to click a link to "confirm" information or pay a fee. USPIS, the law enforcement arm of the Postal Service, has published repeated advisories on this exact scheme. We break the format down fully in our explainer on the USPS text scam.

2. The Fake Bank Fraud Alert

This format hijacks the look of a legitimate fraud alert to trigger panic.

Illustration: "FirstBank Alert: Did you authorize a $487.19 purchase at an electronics retailer? Reply NO to dispute or call 800-555-0147 immediately."

Red flags: the goal is to get you to reply or call a number the scammer controls, where a "fraud specialist" will ask for your account number, PIN, or a one-time passcode. Real banks send fraud alerts, but they will never ask you to read back a passcode or move money to a "safe account." If in doubt, call the number printed on your card, never the number in the text.

3. The Wrong-Number Text

This one starts innocently, with no link at all.

Illustration: "Hey, is this still Amanda's number? It's Kevin from the conference last month."

Red flags: when you reply "wrong number," the sender stays friendly and keeps the conversation going. Over days or weeks it pivots to a romance angle or an investment opportunity, often cryptocurrency. The FBI IC3 has warned about these long-play schemes, sometimes called pig butchering, where the entire relationship exists to set up a fraudulent investment. The safest response to a genuine-seeming wrong number from an unknown contact is no response.

4. The Prize or Giveaway Text

A classic that predates SMS but thrives on it.

Illustration: "Congratulations! Your number was selected in our Spring Rewards drawing. Claim your gift card here before it expires: [link]"

Red flags: you cannot win a contest you never entered. The link leads to a page harvesting personal and payment details, often disguised as a "small shipping fee." The FTC's guidance on prize scams is blunt: legitimate sweepstakes never require payment or financial information to claim a prize.

5. The Unpaid Toll Text

A newer format that spread nationwide as states adopted electronic tolling.

Illustration: "Toll Services Notice: You have an unpaid balance of $6.82. Pay now to avoid a late penalty and DMV referral: [link]"

Red flags: the tiny dollar amount is deliberate, small enough that paying feels easier than checking. The real prize is the card number you enter on the fake payment page. The FBI IC3 issued a public alert about unpaid-toll smishing. If you use toll roads, check your balance by typing your toll authority's website address yourself.

6. The Job Offer Text

This format targets job seekers with effortless, high-paying "opportunities."

Illustration: "Hi! I'm a recruiter with a staffing partner. We reviewed your profile and can offer flexible remote work, $30-$45/hr. Reply YES to learn more."

Red flags: no legitimate employer hires by unsolicited text with no application, interview, or company name you can verify. Follow-on stages often involve "task" platforms where victims deposit their own money to unlock earnings, or fake checks the victim must partially wire back. The FTC classifies these as job scams and advises verifying any recruiter through the company's official careers page.

7. The Account Verification Text

This format impersonates a platform you probably use, such as a streaming service, an email provider, or a payment app.

Illustration: "Your account has been temporarily locked due to unusual sign-in activity. Verify your identity within 12 hours to avoid suspension: [link]"

Red flags: the link leads to a pixel-perfect fake login page that captures your username, password, and sometimes a one-time passcode in real time. Never log in through a link in an unexpected text. Open the app or type the site address yourself. Enabling multi-factor authentication with an authenticator app, rather than SMS codes alone, limits the damage if a password is stolen.

8. The Family Emergency Text

The cruelest format weaponizes love and urgency.

Illustration: "Mom it's me, my phone broke, this is my temp number. I'm in trouble and need $300 for an emergency. Please don't call, just send it here."

Red flags: a new number, a crisis, a request for money, and a reason you cannot call to verify. Scammers gather family details from social media to make these convincing. The defense is a verification habit: call the family member's known number, or ask a question only the real person could answer. Some families agree on a private code word for genuine emergencies.

9. The Fake Charity Text

This format surges after disasters, when generosity is at its peak.

Illustration: "URGENT: Families affected by the flooding need help now. Every dollar counts. Donate instantly here: [link]"

Red flags: unsolicited donation links, pressure to give "instantly," and charities you cannot find independently. The FTC advises researching charities before giving and donating through the organization's own website. This format is especially damaging to legitimate nonprofits, because it teaches donors to distrust text-based fundraising. Real nonprofits combat this by texting only supporters who opted in, from a consistent registered number, with documented security practices.

Quick Reference Table

What to Do With Any Suspicious Text

The response playbook is the same for all nine formats:

1. Do not click links, reply, or call numbers in the message.
2. Verify through an independent channel you locate yourself.
3. Forward the text to 7726 (SPAM), the carrier short code for reporting junk messages.
4. Report the scam to the FTC at ReportFraud.ftc.gov.
5. If you lost money or sensitive data, file a complaint with the FBI IC3 at ic3.gov, and contact your bank right away.
6. Delete the message and block the sender.

Recognizing the format is half the defense. The other half is knowing what legitimate organizational texting looks like: consent-based, from a registered number, consistent in style, and never asking for passwords or payment details. For the three-way comparison of scam channels, see smishing vs. phishing vs. vishing.

Frequently Asked Questions

What is the most common smishing example?

Fake package delivery texts impersonating USPS or private carriers are among the most widely reported smishing formats. They claim a package is held due to an address or fee problem and push the recipient to click a link. USPS does not send unsolicited texts with links about package issues.

Are the sample texts in this article real scam messages?

No. Every sample shown here is an illustrative reconstruction written for training purposes. Each mirrors the structure of scam formats described in FTC consumer alerts, FBI IC3 public service announcements, and USPIS advisories, but none is a quoted real message.

What happens if I click a smishing link?

Clicking alone usually leads to a fake website designed to harvest whatever you type, such as logins or card numbers. Close the page and enter nothing. If you did submit information, change the affected passwords immediately, enable multi-factor authentication, contact your bank if payment data was involved, and report the incident at ReportFraud.ftc.gov and ic3.gov.

How do I report a scam text message?

Forward the message to 7726 (SPAM), which routes it to your wireless carrier for analysis. Then report it to the FTC at ReportFraud.ftc.gov. If money or sensitive information was lost, also file with the FBI Internet Crime Complaint Center at ic3.gov.

How can I tell a real organizational text from smishing?

Legitimate organizations text only people who opted in, send from a consistent registered number, use recognizable branded links, and never request passwords, one-time codes, Social Security numbers, or payment details by text. A message that breaks any of those norms deserves independent verification before you act.

Text Your Community the Trustworthy Way

FRANSiS gives nonprofits, healthcare providers, schools, and government agencies a consent-based SMS platform with a registered sender identity and an AI Powered Helper for two-way conversations, so your real messages never get mistaken for the scams above. Contact us to get started.