Over 300,000 smishing (SMS phishing) attacks are sent every day in the US. Most are obvious once you know what to look for — but scammers have gotten significantly better at mimicking real companies.
Here are the seven signs that reliably separate a scam from a legitimate text.
1. Urgency or threats
Scam texts almost always create artificial time pressure. Phrases like:
- "Your account will be suspended in 24 hours"
- "Immediate action required"
- "Final notice before legal action"
- "Your Social Security number has been compromised"
Urgency is a manipulation tactic. It's designed to make you act before you think. Legitimate organisations — banks, government agencies, delivery companies — don't threaten you by text.
2. The link domain doesn't match the company
This is the single most reliable tell. Before clicking any link in a text:
- USPS texts come from usps.com — not usps-tracking.net, usps-delivery.com, or any variation
- Bank of America texts come from bankofamerica.com
- Amazon texts come from amazon.com
Scammers register domains like usps-parcel-tracking.com or irs-refund-portal.net that look official. Look at the domain, not the display text of the link.
3. Requests for payment or personal information
Legitimate companies almost never ask for:
- Gift card numbers
- Wire transfers
- Social Security numbers
- Bank account or routing numbers
- Passwords or PINs
If a text asks for any of these — in any context, no matter how official it looks — it is a scam.
4. Poor grammar or strange formatting
Many scam operations run from overseas. Look for:
- Odd capitalisation ("Your Package Has Been HELD")
- Missing articles ("Please confirm you address")
- Awkward phrasing ("We has noticed suspicious activity")
This isn't a perfect rule — AI-generated scam texts are now grammatically correct — but it's still a useful signal.
5. The sender number looks wrong
Real company texts usually come from short codes (5-6 digit numbers like 20222) or recognised business names. Be suspicious of:
- Standard 10-digit phone numbers claiming to be from government agencies
- International numbers (starting with +44, +62, etc.) claiming to be US companies
- Numbers you don't recognise with no context
6. You didn't initiate the interaction
Did you recently order a package? If not, a "delivery failed" text is almost certainly a scam. Did you recently contact the IRS? If not, any IRS text is a scam.
The most effective scam texts are ones that seem plausible — but if you think about it, you didn't actually do the thing they're referencing.
7. Requests for secrecy
Any message that asks you to keep something secret from family members is a major red flag. The grandparent scam typically includes: "Please don't tell Mom and Dad." Legitimate organisations never ask for secrecy.
When you're not sure
The safest rule: if you're not sure, don't act. You can always:
- Go directly to the company's website (type it yourself, don't click the link)
- Call the company using a number from their official website
- Forward the message to someone who can check it
Watchover lets your parents forward suspicious texts to a special number and get an instant AI verdict — within seconds, without needing to call you. Learn more here.