You get a text from your bank warning about a suspicious charge. Or from a delivery company saying a parcel is on hold. Or from a tax authority with an outstanding fine. The message looks urgent, looks real, and includes a link to "fix it" in thirty seconds. Before tapping anything, there is one question worth asking: is this legitimate, or is it a scam?
This is called smishing — phishing by SMS — and it is one of the fastest-growing types of fraud worldwide. Unlike email, where years of awareness training have taught people what to look for, text messages create a false sense of closeness and urgency that lowers people's guard. Here are ten signals worth checking before clicking any link.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
1. Does the message ask you to call a number included in the text?
Be cautious with any text message that provides a phone number and asks you to call it to "verify your identity" or "unblock your account". Even when a legitimate institution does include a contact number in an alert, it should always match the official number printed on your card or listed on the institution's real website — never trust a number simply because it appears inside the suspicious message itself. If in doubt, look up the number independently and call that instead.
2. Does the link use a URL shortener?
Banks, government agencies and mobile carriers rarely use generic URL shorteners (bit.ly, tinyurl, rb.gy and similar) in official communications — most large institutions use their own branded short domains, if any. A generic shortener hides the real destination of the link, which is a technique designed to stop you from verifying where it leads before clicking.
3. Is there artificial urgency?
"Act within the next 24 hours", "your account will be locked today", "your parcel will be returned if you don't confirm now". Time pressure is the most effective tool scammers have: the less time you have to think, the less likely you are to spot the warning signs. Any message pushing you to act immediately deserves suspicion.
4. Does it ask for banking details, passwords or verification codes?
No legitimate institution asks for your card number, your password or a one-time verification code via SMS, WhatsApp or any other messaging channel. If a message directly requests this information, or redirects you to a website asking for it, it is fraud.
5. Is the sender's number international and unexpected?
A text claiming to be from your local bank but arriving from an unfamiliar international prefix is an immediate red flag. Legitimate institutions normally send messages from recognised short codes or local numbers consistent with your country — not from random overseas numbers.
6. Does the link point to a domain you don't recognise?
Before clicking, check the full domain of the link, not just the name shown in the text. A message claiming to be from a delivery company with a link to something like "delivery-tracking-update.info" is not the real company — the official domain is the one you already know. Scammers use look-alike domains to create quick visual trust.
7. Are you being offered a prize you never entered for?
"You've won a prize", "Congratulations, you've been selected" — if you didn't enter any draw or competition, you cannot have won anything. This is one of the oldest smishing techniques and it still works because it appeals directly to surprise and greed.
8. Is it a work-from-home job offer with a link?
Messages offering "work from home", "extra income" or "easy paid tasks" with a link to "sign up" are usually hooks for personal data theft or advance-fee scams. A genuine job offer does not arrive via unsolicited SMS with a direct sign-up link.
9. Did the message appear inside an existing thread with your bank?
This is one of the more sophisticated techniques: attackers manage to get their text to appear in the same conversation thread as your bank's legitimate messages, exploiting the fact that the number is already saved under that name on your phone. If a suspicious phone number or link suddenly appears inside a thread of messages from your bank, it is an injected fraudulent message, not a real communication from the bank.
10. Do you trust the brand but not the message?
The most important signal is your own instinct. If something about the tone, the grammar, the timing or the content of the message feels off, do not click. No legitimate text message from an official body or a bank will disappear because you waited five minutes to verify it.
What to do if you're unsure
Do not click the link. Do not call the number included in the text. If you want to verify whether the message is legitimate, contact your bank or the institution directly using the official number you already had before receiving the text — never the one shown in the suspicious message.
For an immediate technical check, you can paste the full text of the SMS into the ORTSLAB scanner. The engine automatically analyses the sender, the links, any phone numbers and social engineering patterns in seconds, with no registration required.
If you have already provided banking details or clicked a smishing link, contact your bank immediately to block any potential charges, and report the incident to your country's relevant cybersecurity or consumer protection authority.