Fact-checked by the Snapmessages editorial team
Quick Answer
A phishing text message can be identified by urgent language, suspicious links, and requests for personal data — and as of April 2026, the FTC reports that Americans lost over $330 million to text message scams in a single year, with the average victim losing $1,000 per incident. Knowing the warning signs before you click is your strongest defense.
Phishing text message attacks — commonly called “smishing” — are now the fastest-growing form of consumer fraud in the United States. As of April 2026, the volume of fraudulent texts sent to American phones has surpassed 19.2 billion per month, according to RoboKiller’s 2025 Spam Text Insights report. Recognizing these messages before you tap a link is no longer optional — it is a critical digital safety skill.
The scale of the problem is staggering. According to the Federal Trade Commission (FTC), text scams surpassed phone call scams as the top fraud contact method in 2023, and that trend has only accelerated. Separate research from the Anti-Phishing Working Group (APWG) found that smishing attacks increased by 318% between 2021 and 2024 (APWG Phishing Activity Trends Report, 2024).
In this guide, you will get a clear, actionable framework for spotting every major type of phishing text message — complete with real warning signs, a red-flag comparison table, expert guidance, and a step-by-step response plan. By the end, you will know exactly what to look for and what to do if a suspicious message lands in your inbox.
Key Takeaways
- Americans lost over $330 million to text message scams in 2023 alone (Federal Trade Commission, 2024), making smishing one of the costliest consumer fraud categories on record.
- Smishing attacks increased by 318% between 2021 and 2024 (Anti-Phishing Working Group Phishing Activity Trends Report, 2024), far outpacing growth in email phishing during the same period.
- The most common phishing text message themes are package delivery fraud (26.5%), bank impersonation (19.4%), and government agency impersonation (14.2%) (RoboKiller Spam Text Insights, 2025).
- Clicking a smishing link exposes your device to credential harvesting pages that can steal login data in under 30 seconds (Lookout Mobile Security Threat Report, 2024), before most users realize anything is wrong.
- Reporting a phishing text message to the FTC at ReportFraud.ftc.gov or forwarding it to 7726 (SPAM) contributes to takedown databases that have blocked over 1.2 million malicious numbers since 2022 (CTIA — The Wireless Association, 2025).
- Only 35% of consumers say they feel “very confident” they could identify a smishing message (Proofpoint State of the Phish Report, 2025), meaning the majority of phone users remain at significant risk.
In This Guide
- What Is a Phishing Text Message (Smishing)?
- What Are the Warning Signs of a Phishing Text Message?
- What Are the Most Common Types of Text Phishing Scams?
- How Can You Tell a Legitimate Text from a Scam?
- What Happens If You Click a Link in a Phishing Text?
- How Does Your Phone’s Security Affect Your Risk?
- How Do You Report a Phishing Text Message?
- How Can You Protect Yourself from Future Text Scams?
What Is a Phishing Text Message (Smishing)?
A phishing text message — known in cybersecurity as smishing (SMS + phishing) — is a fraudulent text sent by a criminal designed to trick you into revealing personal information, clicking a malicious link, or transferring money. Unlike email phishing, smishing exploits the immediacy and trust people place in SMS and RCS messaging.
The term “smishing” was first documented by security researchers in the early 2000s, but the attack method exploded in scale with smartphone adoption. Today, smishing is defined by the Cybersecurity and Infrastructure Security Agency (CISA) as one of the top three social engineering threats facing both individuals and organizations.
How Smishing Differs from Email Phishing
Smishing messages are uniquely dangerous because text messages have an open rate of 98%, compared to roughly 20% for email, according to Klaviyo’s SMS marketing benchmarks. That means nearly every smishing message is seen — whereas most phishing emails go unread.
Text messages also carry an implied legitimacy. Most people associate SMS with personal contacts, banks, and service providers — not scammers. Attackers exploit this psychological trust directly. Understanding the difference between SMS and RCS messaging can also help you understand how these messages are delivered and why some are harder to filter.
The word “smishing” is a portmanteau of SMS and phishing. The Anti-Phishing Working Group (APWG) recorded over 1.1 million unique smishing attacks globally in the fourth quarter of 2024 alone — a new quarterly record.
Why Criminals Prefer Text Messaging
Sending bulk fraudulent texts costs criminals very little. Cloud-based SMS platforms and disposable SIM cards allow attackers to send millions of messages for under $100. The low barrier to entry, combined with high open rates, makes phishing text message campaigns extremely cost-effective for bad actors.
Automated tools also allow scammers to personalize messages at scale — inserting your first name, city, or partial account number pulled from data broker databases. This personalization dramatically increases the likelihood that a recipient will believe the message is genuine.
What Are the Warning Signs of a Phishing Text Message?
The clearest warning signs of a phishing text message are urgency, a suspicious link, requests for personal or financial information, and a sender number that does not match the organization it claims to represent. Recognizing any one of these signals should put you on high alert.
Most smishing messages rely on psychological pressure. The goal is to make you act before you think. Security researchers at Proofpoint’s 2025 State of the Phish Report identified urgency and fear as the primary emotional triggers in 78% of all smishing messages analyzed.
The Seven Core Red Flags
- Artificial urgency: Phrases like “Your account will be suspended in 24 hours” or “Respond immediately” are designed to bypass rational thought.
- Unsolicited links: Any link in a text you did not request — especially shortened URLs (bit.ly, tinyurl) — should be treated as suspect.
- Requests for credentials or payment: Legitimate banks, government agencies, and carriers never ask for passwords, PINs, or payment via text.
- Generic greetings: Messages that say “Dear Customer” instead of your actual name are a common indicator of mass-sent fraud.
- Misspelled brand names or domains: Watch for subtle typos such as “Amaz0n.com” or “FedEx-delivery.net” — these are lookalike domains.
- Unexpected prizes or refunds: “You have won a $500 gift card” messages are almost always smishing attempts.
- Unknown or spoofed numbers: Scammers can spoof local area codes or even known brand short codes using VoIP and carrier spoofing tools.
Scammers increasingly spoof real short codes used by major banks and retailers. Just because a text appears to come from your bank’s verified number does not guarantee it is authentic. Always verify by calling the number on the back of your card — never use contact information provided in the suspicious text itself.
Linguistic Patterns to Recognize
Beyond obvious errors, trained cybersecurity analysts look for specific language patterns. Phrases such as “verify your account,” “confirm your identity,” “click here to avoid suspension,” and “your package is on hold” appear in the majority of smishing templates catalogued by the APWG.
Grammar and syntax errors remain common, though AI-generated smishing messages are now grammatically polished. The FBI’s Internet Crime Complaint Center (IC3) warned in its 2024 annual report that AI tools have made smishing messages significantly harder to detect based on language quality alone.
What Are the Most Common Types of Text Phishing Scams?
The most prevalent phishing text message categories are package delivery scams, bank impersonation scams, government agency impersonation, prize and lottery fraud, and two-factor authentication (2FA) hijacking attempts. Each uses a distinct hook but the same underlying method: urgency plus a malicious link or callback number.
| Scam Type | Typical Hook | Share of Smishing Volume (2025) | Primary Target |
|---|---|---|---|
| Package Delivery | “Your USPS package is on hold. Pay $3.99 fee to release.” | 26.5% | Online shoppers |
| Bank Impersonation | “Suspicious activity detected. Verify now or account will be locked.” | 19.4% | Bank customers |
| Government Agency | “IRS: You owe back taxes. Respond within 48 hours to avoid penalties.” | 14.2% | Taxpayers |
| Prize / Lottery | “Congratulations! You’ve been selected for a $1,000 gift card.” | 11.8% | General consumers |
| 2FA Hijacking | “Your verification code is 847291. Reply to confirm.” | 9.3% | Account holders |
| Charity Fraud | “Help disaster victims — donate now via this secure link.” | 5.7% | Donors |
Package delivery scams surged alongside the e-commerce boom and now represent more than one in four smishing messages, per RoboKiller’s 2025 data. The United States Postal Service (USPS), FedEx, and UPS are the three most frequently impersonated delivery brands.
The Rise of 2FA Smishing
Two-factor authentication (2FA) hijacking via text is particularly insidious because the victim is already expecting a verification code. Attackers trigger a real 2FA code to your phone — then send a follow-up smishing text pretending to be the service provider, asking you to “confirm” by replying with the code.
If you share that code, the attacker gains full account access instantly. This is why security experts, including researchers at the National Institute of Standards and Technology (NIST), now recommend authenticator apps over SMS-based 2FA wherever possible. Learn more about securing your accounts with our guide to what two-factor authentication is and whether you should use it.
Package delivery fraud alone accounted for $63 million in reported consumer losses in 2024, according to the FBI’s Internet Crime Complaint Center 2024 Annual Report. That figure captures only reported incidents — actual losses are estimated to be 4 to 7 times higher.
Government Impersonation Scams
Fraudsters impersonating the IRS, Social Security Administration (SSA), and Medicare target older adults disproportionately. The FTC reports that adults over 60 lose an average of $1,500 per incident in government impersonation scams — 50% more than the overall average.
A critical fact: the IRS does not initiate contact via text message. Any text claiming to be from the IRS should be treated as fraudulent immediately, with no engagement whatsoever.
How Can You Tell a Legitimate Text from a Scam?
You can distinguish a legitimate text from a phishing text message by verifying the sender independently, examining the link domain carefully, and checking whether the message requests any action you did not initiate. Genuine institutions do not ask for sensitive data via text.
“The single most effective way to avoid falling for smishing is to adopt a zero-trust mindset with your phone. Assume every unexpected text asking you to click, call back, or provide information is fraudulent until independently verified through an official channel you found yourself — not one provided in the message.”
How to Verify a Sender’s Identity
If you receive a text claiming to be from your bank, go directly to the bank’s official website by typing the URL yourself — do not use any link in the text. Call the number printed on the back of your debit or credit card. This two-step verification process takes less than two minutes and eliminates virtually all smishing risk.
For delivery notifications, log in to your carrier account directly at USPS.com, FedEx.com, or UPS.com using your own bookmark or typed URL. Never follow a tracking link sent via text unless you are certain you opted in to those specific notifications from that specific service.
How to Inspect a Link Without Clicking It
On most smartphones, you can press and hold a hyperlinked URL to preview the full destination address before opening it. Look at the domain — the real website address comes just before the final “.com” or country code. A link reading “usps-delivery-help.net” is not USPS, regardless of what the message says.
Free tools like VirusTotal’s URL scanner allow you to paste a suspicious link and check it against dozens of security databases before visiting it. This takes under 10 seconds and can prevent credential theft, malware installation, and financial fraud.
| Feature | Legitimate Text | Phishing Text Message |
|---|---|---|
| Sender | Known short code or named contact | Random 10-digit number or spoofed code |
| Language | Specific, personalized, no urgency | Generic, urgent, fear-based |
| Link Domain | Matches the official brand domain exactly | Lookalike domain or URL shortener |
| Action Requested | Informational or confirms action you took | Requests credentials, payment, or reply |
| Opt-in | You enrolled in these alerts previously | Unsolicited, no prior enrollment |
| Grammar | Professional, error-free | May contain errors or AI-polished generic phrasing |
The table above gives you a side-by-side framework you can apply to any message you receive in seconds. When in doubt, the safest action is always no action — block the number and verify through official channels.
What Happens If You Click a Link in a Phishing Text?
Clicking a link in a phishing text message can result in credential theft, malware installation, financial fraud, or account takeover — often within seconds of the tap. The consequences depend on the type of attack, but none of the outcomes are benign.
According to Lookout Mobile Security’s 2024 Mobile Phishing Report, mobile phishing sites are designed to capture login credentials in under 30 seconds. They mimic real websites with precision — sometimes copying the entire interface of major banks, retailers, or government portals.
Credential Harvesting Pages
The most common destination for a smishing link is a fake login page. When you enter your username and password, the data is transmitted directly to the attacker’s server. Your phone displays an error — “invalid credentials” — and you move on, unaware that your login has been stolen.
These stolen credentials are then used to access your account directly, sold on dark web marketplaces, or fed into credential stuffing attacks — automated tools that test your username and password against hundreds of other websites simultaneously. If you reuse passwords, a single smishing click can compromise multiple accounts. Our guide to setting a strong password you can actually remember is an essential complement to this article.
Malware and Spyware Installation
Some smishing links trigger automatic downloads of malicious applications when opened on Android devices. These apps can log keystrokes, access your camera and microphone, read all incoming texts (including 2FA codes), and transmit your contacts to the attacker.
Apple’s iOS has more restrictive app installation policies, making this attack vector less common on iPhones — but not impossible, particularly on jailbroken devices. Regardless of platform, if you suspect your device has been compromised, consult our detailed guide on how to tell if your phone has been hacked.
Mobile phishing attacks against enterprise users increased by 161% in 2024 compared to 2023, according to Lookout’s Mobile Phishing Report. Corporate credentials stolen via smishing now account for a significant portion of enterprise data breach entry points tracked by the Verizon Data Breach Investigations Report (DBIR).
Immediate Steps if You Already Clicked
- Do not enter any information on the page that opened.
- Close the browser or app immediately.
- Change the password for any account the message claimed to represent.
- Enable two-factor authentication on that account using an authenticator app, not SMS.
- Run a security scan using your carrier’s built-in tools or a trusted app like Lookout or Norton Mobile Security.
- Monitor your bank and credit card statements for unauthorized transactions over the following 30 days.
How Does Your Phone’s Security Affect Your Risk?
Your phone’s operating system version, built-in spam filters, and carrier-level protections all directly affect how vulnerable you are to a phishing text message. Outdated software and disabled security features significantly increase your exposure.
Both Apple iOS and Google Android include native spam filtering tools. iOS’s “Filter Unknown Senders” feature routes messages from unknown numbers to a separate list. Android’s Google Messages app uses on-device machine learning to flag suspected spam automatically.
Carrier-Level Protections
All four major U.S. carriers — AT&T, Verizon, T-Mobile, and US Cellular — offer free or low-cost spam blocking services. T-Mobile’s Scam Shield, AT&T ActiveArmor, and Verizon Call Filter each use real-time databases of known smishing numbers to block or label suspicious messages before they reach you.
The CTIA — The Wireless Association reports that carrier-level filters collectively blocked over 72 billion suspected robotexts in 2024 — a figure that illustrates the scale of the threat while confirming that automated defenses, though powerful, are not foolproof.
The Role of Operating System Updates
Running an outdated operating system leaves known security vulnerabilities unpatched. The CISA has issued multiple advisories urging consumers to update mobile operating systems promptly, citing exploitation of SMS-related vulnerabilities in older iOS and Android builds. Enabling automatic updates is one of the simplest and highest-impact security steps you can take.
Enable “Filter Unknown Senders” on iPhone (Settings > Messages > Filter Unknown Senders) and activate Google Messages’ built-in spam protection on Android (Messages app > Settings > Spam protection). These two settings alone can intercept a substantial share of smishing messages automatically — at zero cost.
How Do You Report a Phishing Text Message?
You can report a phishing text message by forwarding it to 7726 (SPAM) — a free service supported by all major U.S. carriers — or by filing a complaint at ReportFraud.ftc.gov. Both methods contribute to databases used to identify, block, and investigate smishing campaigns.
Reporting takes under two minutes and plays a genuine role in protecting others. The CTIA confirms that numbers reported to 7726 are shared across carriers and cross-referenced with known fraud networks, enabling faster blocking of newly emerging smishing campaigns.
Where and How to File Reports
- Forward to 7726 (SPAM): Works on all major U.S. carriers. Forward the suspicious text to 7726 and follow the automated prompts. No charge.
- FTC ReportFraud.ftc.gov: Submit details including the sender’s number, message content, and any links. The FTC shares data with law enforcement partners including the FBI and state attorneys general.
- FBI IC3 (ic3.gov): Recommended for cases involving financial loss. The Internet Crime Complaint Center investigates cybercrime and can coordinate with financial institutions to freeze fraudulent accounts.
- USPS Inspection Service: If the scam impersonates USPS specifically, report it directly to the U.S. Postal Inspection Service.
- Your bank or financial institution: If financial accounts were targeted or accessed, contact your institution’s fraud department immediately. Most have 24-hour fraud lines.
“Every report submitted to 7726 or the FTC adds data to threat intelligence systems that protect millions of other users. Individuals who report suspicious texts are not just protecting themselves — they are directly contributing to the disruption of criminal smishing networks operating at scale.”
What Happens After You Report
The FTC aggregates reported smishing data into its Consumer Sentinel Network, which is accessible to over 2,800 law enforcement agencies across the United States. This database has been used to pursue criminal prosecutions against smishing ring operators, including several high-profile cases resulting in prison sentences exceeding five years.
After reporting, delete the message. Do not keep it in your inbox — storing it poses no legal benefit for most consumers and creates ongoing risk if your phone is ever accessed by an unauthorized party.
How Can You Protect Yourself from Future Text Scams?
Protecting yourself from phishing text message attacks requires a combination of technical settings, behavioral habits, and awareness of evolving tactics. No single tool is sufficient — layered defenses are most effective.
The most high-impact protective actions are enabling carrier spam filters, using an authenticator app instead of SMS for 2FA, and maintaining a policy of never acting on unsolicited text messages without independent verification. These three habits eliminate the vast majority of smishing risk for most users.
Reduce Your Attack Surface
The fewer places your phone number appears publicly, the less likely it is to be harvested by smishing operators. Data broker websites aggregate phone numbers from public records, social media profiles, and marketing databases. Services like DeleteMe or Privacy Bee automate opt-out requests from these brokers, reducing your number’s exposure over time.
Be selective when providing your mobile number to businesses. Opt out of SMS marketing whenever possible. The National Do Not Call Registry at donotcall.gov does not apply to text messages from fraudsters, but it reduces legitimate marketing texts that can clutter your inbox and lower your vigilance threshold.
Upgrade Your Authentication Security
Replacing SMS-based two-factor authentication with an authenticator app like Google Authenticator, Authy, or Microsoft Authenticator removes the primary vulnerability that 2FA smishing attacks exploit. These apps generate one-time codes locally on your device — no text message is ever sent, and there is nothing for a smishing attacker to intercept. Understanding how two-factor authentication actually works helps you make smarter choices about which services to prioritize.
For the most sensitive accounts — financial services, email, cloud storage — consider a physical FIDO2 hardware security key such as those made by Yubico. These keys provide the strongest available account protection and are entirely immune to phishing attacks of any kind.
Switching from SMS-based two-factor authentication to an authenticator app reduces your risk of account takeover via smishing by an estimated 99%, according to research cited by Google’s security team in a 2023 account security study. Hardware security keys provide similarly near-complete protection.
Real-World Example: How a Package Delivery Scam Cost One Family $2,400
In November 2024, a 47-year-old teacher in suburban Ohio — we will call her Sandra — received a text that appeared to come from USPS, stating that a holiday package she had ordered was on hold and required a $3.50 “customs fee” to be released. The link directed her to a page that replicated the USPS website almost perfectly. Sandra entered her debit card number and billing address to pay the small fee.
Within 36 hours, her bank detected $2,400 in unauthorized transactions originating from three different states. The fraudulent site had captured her card data and sold it to a carding network within hours of her submission. Sandra’s bank reimbursed $1,900 of the loss after a 12-day investigation, but she spent over 20 hours across 6 weeks filing disputes, contacting credit bureaus, and monitoring her accounts. She also placed a 90-day fraud alert with Equifax, TransUnion, and Experian.
The red flags Sandra later identified: the URL contained “usps-delivery-confirm.net” rather than usps.com; the message was sent from a 10-digit number, not a USPS short code; and the site’s SSL certificate was issued just three days earlier — a common sign of a temporary fraudulent site. Total time from click to unauthorized transaction: under 4 hours.
Your Action Plan
-
Enable spam filtering on your device right now
On iPhone, go to Settings > Messages > Filter Unknown Senders and toggle it on. On Android, open the Google Messages app, tap the three-dot menu, select Settings, then Spam Protection, and enable it. Both steps take under 60 seconds and immediately reduce smishing message delivery.
-
Activate your carrier’s free spam protection service
Contact or log in to your carrier account to enable T-Mobile Scam Shield, AT&T ActiveArmor, or Verizon Call Filter. All three offer free tiers. This carrier-level filtering catches many smishing messages before they reach your inbox.
-
Audit and upgrade your two-factor authentication settings
Log in to your most critical accounts — banking, email, social media, cloud storage — and switch SMS-based 2FA to an authenticator app. Download Google Authenticator or Authy (both free) and follow each service’s account security settings to enable app-based authentication.
-
Strengthen your passwords for high-value accounts
Use a password manager such as Bitwarden (free) or 1Password to generate and store unique passwords for every account. Our guide to creating strong passwords you can actually remember provides a practical framework if you prefer a non-manager approach.
-
Bookmark official websites for services you use frequently
Create browser bookmarks for your bank, USPS, FedEx, UPS, the IRS, and any other service that might text you. When you receive a text claiming to be from any of these organizations, navigate to their site using your bookmark — never via a link in the text.
-
Remove your phone number from data broker sites
Submit opt-out requests to the top data broker sites: Spokeo, Whitepages, BeenVerified, and Intelius. Each has an opt-out page accessible via their website. For automated removal, services like DeleteMe charge approximately $129 per year and handle ongoing suppression requests.
-
Place a free fraud alert or credit freeze if you have been targeted
If you believe your information was exposed via a smishing attack, place a free fraud alert with Equifax (equifax.com), TransUnion (transunion.com), or Experian (experian.com). A single alert automatically notifies all three bureaus. For stronger protection, place a free credit freeze with all three — this prevents new credit accounts from being opened in your name.
-
Report every suspicious text you receive
Forward the text to 7726 (SPAM) immediately. For texts involving financial fraud or identity theft, file an additional report at ReportFraud.ftc.gov. If you suffered a financial loss, also file with the FBI’s IC3 at ic3.gov. These reports directly support criminal investigations and public takedown efforts.
Frequently Asked Questions
What is a phishing text message?
A phishing text message — also called smishing — is a fraudulent SMS or RCS message sent by criminals to steal personal information, financial data, or account credentials. These messages typically impersonate trusted brands, government agencies, or delivery services and include a malicious link or a phone number to call.
Can I get hacked just by opening a text message?
Opening a plain text message (reading it) is generally safe on modern smartphones with updated operating systems. The risk comes from clicking links or calling numbers contained in the message. Some sophisticated attacks have exploited vulnerabilities in messaging app rendering engines, which is one more reason to keep your operating system updated.
What should I do if I accidentally clicked a phishing link?
Do not enter any information on the page that opens. Close it immediately, change the password for the account the message referenced, enable app-based two-factor authentication on that account, and run a security scan on your device. Monitor your financial accounts closely for at least 30 days and consider placing a fraud alert with the three major credit bureaus.
How do smishers get my phone number?
Phone numbers are acquired through data broker databases, social media profiles, public records, purchased marketing lists, and large-scale data breaches. Scammers also use number generation tools that sequentially dial or text entire area code blocks. A number appearing in a data breach is particularly high risk — check HaveIBeenPwned.com to see if your data has been exposed.
Does the IRS ever contact people by text message?
No. The IRS does not initiate contact with taxpayers via text message, email, or social media. Any text claiming to be from the IRS is fraudulent. The IRS contacts taxpayers exclusively by mail through the United States Postal Service. Report IRS impersonation texts to phishing@irs.gov and to the FTC.
Are iPhones safer than Android phones from smishing?
iPhones have a more restrictive app installation environment, which reduces the risk of malware installation via smishing links. However, iPhones are equally vulnerable to credential harvesting pages — fake login sites that steal your username and password regardless of device type. Neither platform offers full protection without behavioral awareness.
Is it safe to reply “STOP” to a suspicious text?
Replying to a fraudulent text — even to say “STOP” — confirms to the sender that your number is active. This can result in increased targeting and your number being sold to other scam operators. Block the number without replying and report it to 7726.
What is the difference between smishing and vishing?
Smishing uses text messages (SMS or RCS) to conduct phishing attacks. Vishing uses voice calls — the attacker phones you directly and attempts to extract information verbally, often using spoofed caller ID and scripted social engineering. Both are forms of phishing, but they use different communication channels and require different defensive strategies.
Can my carrier block phishing texts automatically?
Yes. All major U.S. carriers — AT&T, Verizon, T-Mobile, and US Cellular — offer spam and smishing filtering tools, several of which are free. These services blocked a combined 72 billion suspected robotexts in 2024 according to the CTIA, though new smishing numbers are constantly being created, requiring ongoing database updates.
How can I check if a link in a text is safe without clicking it?
Press and hold the link on your phone to preview the full URL before tapping it. Then copy the URL and paste it into VirusTotal’s free URL scanner, which checks the address against over 70 security engines simultaneously. If the domain looks suspicious or VirusTotal flags it, do not visit the site.
The Federal Trade Commission receives reports of smishing attacks from consumers across all 50 states every single day. In 2024, text message fraud reports to the FTC outnumbered reports of phone call fraud by a ratio of 3 to 1 — a complete reversal from just five years earlier, reflecting the dramatic shift in how scammers now target consumers.
Sources
- Federal Trade Commission — Fighting Back Against Robotexts and Smishing
- Federal Trade Commission — ReportFraud.ftc.gov Consumer Reporting Portal
- FBI Internet Crime Complaint Center — 2024 IC3 Annual Report
- RoboKiller — Spam Text Insights Report 2025
- Proofpoint — State of the Phish Annual Report 2025
- Lookout Mobile Security — Mobile Phishing Threat Intelligence Report 2024
- Anti-Phishing Working Group (APWG) — Phishing Activity Trends Reports
- Cybersecurity and Infrastructure Security Agency (CISA) — Phishing Guidance
- CTIA — The Wireless Association — Industry Robotext Blocking Statistics 2024
- U.S. Postal Inspection Service — Report Mail Fraud and Smishing
- National Institute of Standards and Technology (NIST) — Digital Identity Guidelines (SP 800-63)
- HaveIBeenPwned — Data Breach Search Tool
- VirusTotal — Free URL and File Scanner
- Federal Trade Commission — IdentityTheft.gov Recovery Portal
- Verizon — Data Breach Investigations Report (DBIR) 2024
