A text lands on your phone claiming your bank spotted unusual activity on your account. The message looks legit, it may even sit beside your real bank texts, but every word is fake. This is smishing, a scam that uses text messages to steal your login details, card numbers, and money. Here is how to spot a fake bank text and what to do when one arrives.
What is smishing?
Smishing is phishing that arrives by SMS. The name blends "SMS" and "phishing," and the goal matches a fake email: trick you into handing over sensitive information. Scammers send a text that appears to come from your bank, a courier, a government agency, or a retailer, and pressure you to act fast. It usually asks you to click a link, call a number, or reply with details. If you have ever wondered how to spot a fake PayPal email, the warning signs are nearly identical, just delivered by text.
Why the text appears inside your real bank thread
Here is the trick that makes smishing especially dangerous: the fake text can land inside the same thread as your genuine bank messages. Attackers spoof sender IDs, meaning they can make a text appear to come from your bank's short code or name even though it was not sent by the bank. Your phone groups the spoofed message with the authentic ones, so it looks like part of an official conversation you already trust.
Sender IDs are not phone numbers. They are names or short codes shown on your screen, and scammers can fake them with the right tools. Do not trust the thread, trust the content. A real bank will never text you asking to confirm a password, PIN, or full card number.
The classic fake bank text templates
Most smishing messages reuse a handful of proven templates. Learn these patterns and you can spot a fake bank text in seconds:
- "Unusual activity detected" texts claiming a large or foreign purchase was made, with a link to "verify" or "secure" your account.
- "Your account is locked" messages threatening to suspend your account unless you confirm your details right away.
- "Confirm a delivery" texts from fake couriers asking you to pay a small fee or click a tracking link.
- "You have a refund" messages promising money back and asking for your card details to "receive" it.
Every template shares the same two ingredients: a sense of urgency and a request to act without thinking.
How to verify without clicking anything
The single most useful habit is to never tap the link in a suspicious text. Instead, verify the claim through a channel you control:
- Call the number printed on the back of your debit or credit card.
- Open your bank's official app and check your balance and recent activity.
- Log in to the bank's website by typing the address yourself, never from a text link.
- For delivery texts, check the courier's official app or site with the tracking number.
If the claim is real, you will see it in your account or the courier's system. Otherwise, the message was almost certainly a scam.
Never reply "STOP" or "YES" to a suspicious text
Your first instinct may be to reply "STOP" to stop the messages, or to text "YES" to tell the sender they have the wrong number. Do not do either. Replying confirms your number is live and watched by a real person, making it more valuable to scammers. It can be sold to other fraudsters or targeted with more aggressive attacks.
The safest response is none. Block the number, delete the message, and follow the reporting steps below.
How to report smishing and protect your accounts
Reporting a fake bank text takes under a minute and genuinely helps. Here is the sequence to follow:
- Forward the text to 7726 (SPAM). This free service, run by phone carriers, collects scam texts and works to block the numbers behind them.
- Report it to your bank. Most banks have a dedicated number or email for fraud reports; if unsure, call the number on the back of your card.
- Report it to the FTC at reportfraud.ftc.gov. The details you share help investigators spot new scam campaigns early.
- Report internet-based versions of the scam to the FBI IC3 at ic3.gov.
If you already tapped a link or entered details, call your bank, change your passwords, and consider a service like Scam Guard to screen for suspicious messages. For a fuller breakdown of the steps, see our guide on how to report phishing and scams.
FAQ
What is smishing? Smishing is phishing delivered by text message. Scammers pose as your bank, a courier, or another trusted company to trick you into clicking a link or sharing sensitive information.
Can scammers make a fake bank text appear inside my real message thread? Yes. Attackers can spoof sender IDs, so a fake text can show up in the same conversation as your genuine bank messages. Trust the content, not the thread.
Should I reply "STOP" to a smishing text? No. Replying confirms to scammers that your number is active, which can lead to more spam and more targeted attacks. Block the number and delete the message instead.
How do I report a fake bank text? Forward the text to 7726 (SPAM), report it to your bank, and file a report with the FTC at reportfraud.ftc.gov. If you lost money or shared account details, also report it to your local police and the FBI IC3.
Sources and further reading
---Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.