What is smishing?

Updated 2026-05-02

Smishing is phishing delivered by text message. UK consumers receive an estimated 45 million scam texts per day. The format works because texts feel personal, urgent, and harder to verify than email.

Common smishing campaigns

Royal Mail redelivery, HMRC tax refunds, NHS appointments, banking 'unusual activity', DHL/FedEx parcel fees, and 'Hi mum/dad, I've lost my phone' WhatsApp transfers.

Why it's effective

Mobile screens hide URLs, urgency overrides scrutiny, and the small ask (£1.99 fee, 'just confirm your details') feels low-stakes. Once data is harvested, the real harm is identity fraud weeks later.

Defence checklist

Don't tap links in unsolicited SMS. Forward to 7726. Verify directly via the company's official app or website. Keep iOS and Android updated for the latest URL-blocking lists.

Frequently asked questions

Is replying STOP safe?

Replying to genuine marketing texts (TPS-registered senders) is fine. Replying to scams confirms your number is active and invites more — don't reply, just forward to 7726.