📱 Smishing Scams UK — Fake Texts Explained

Sunday, 02 August 2026

Smishing (SMS phishing) is a scam delivered by text message. Criminals send texts pretending to be your bank, a delivery company, the government, or a streaming service — with a link that steals your details.

It's one of the most common scams in the UK because almost everyone reads their texts. This guide shows you how to spot smishing and what to do.

The most common smishing texts

Fake text The trick
"Your account is locked — verify now" Link to a fake banking page that steals your login
"A payment of £499 was made — not you? Cancel here" Urgency → fake page → card details
"Your parcel is held at the depot" Redelivery fee → card harvesting (see our parcel text guide)
"You're owed a refund/tax rebate" Fake refund page asking for bank details
"Your Netflix/Amazon/Apple ID expires today" Fake subscription page → card details
"Your number has won a prize" Advance fee or data harvesting
"Driver update needed for your delivery" Malware download disguised as an app

How to spot a smishing text

  • The sender — texts come from random mobile numbers or shared shortcodes, not from "Barclays" or "RoyalMail"
  • A link — genuine companies rarely send links in texts; if they do, the domain must match exactly
  • Urgency — "immediate action", "account suspended", "final attempt"
  • A payment request — "£2.99 redelivery fee", "confirm your card to stop the charge"
  • Generic greeting — "Dear customer" rather than your name
  • Too good or too bad — a surprise refund or a surprise charge

⚠️ The golden rule: never click a link in an unexpected text. If your bank, courier, or service really needs you, log in through their official app or website — typed yourself, not via the text.

What happens if you click

  • You land on a fake page that looks like the real thing
  • You enter your card or login details — now the scammers have them
  • They may install malware if the link downloads an "app"
  • Your details are tested and sold within minutes

What to do if you've clicked and entered details

  1. Call your bank's fraud line immediately — cancel the card, check for test transactions
  2. Report to Action Fraud — 0300 123 2040 or actionfraud.police.uk
  3. Get a crime reference number — see our guide
  4. Forward the text to 7726 — free, all networks, alerts your provider to block the sender
  5. Change your passwords if you reused them
  6. If money was taken, see how to get your money back after a scam

Why 7726 matters

7726 is the free reporting number used by all UK mobile networks (it spells "SPAM" on a keypad). Forwarding a suspicious text to 7726:

  • Alerts your network to the sender
  • Helps block the number network-wide
  • Feeds intelligence to protect others

Do this for every suspicious text. It takes 10 seconds.

The variants to watch

  • "Hi Mum" family scams — see our guide
  • Delivery texts — see our parcel text guide
  • Bank impersonation — your bank will never text a link asking you to verify
  • One-time code theft — never share a code that arrives by text, with anyone, for any reason

Protect yourself

  • ❌ Never click links in unexpected texts
  • ❌ Never share one-time codes
  • ❌ Never call numbers in suspicious texts — find the official number yourself
  • ✅ Forward suspicious texts to 7726
  • ✅ Use your bank's app-based authentication instead of SMS codes where available
  • ✅ Set "silence unknown callers" and spam filters on your phone
  • ✅ Tell older relatives — they're the most targeted

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.