Smishing (SMS phishing) has become one of the most common fraud delivery methods of 2026. It arrives in the most trusted channel most people have: their personal phone number, via text message.
AI has transformed smishing from a mass-broadcast spam operation into a precision tool. Scammers now craft personalized messages that reference your name, your carrier, your recent order history, or your bank information pulled from data breaches and data brokers. The messages are short, urgent, and designed to generate a single action: tap the link.
The Most Common Smishing Themes
- Package delivery: “Your USPS package could not be delivered. Confirm your address:” [fake link]
- Bank alerts: “Unusual activity detected on your account. Verify now:” [fake link]
- Government notices: “Your tax refund is pending. Claim it here:” [fake link]
- Toll payment: “You have an outstanding toll balance. Pay now to avoid fees:” [fake link]
- Prize notifications: “You’ve been selected for a reward. Click to claim:” [fake link]
The U.S. Postal Inspection Service specifically warns that USPS will never send unsolicited texts asking for personal or financial information. If you receive one, do not click the link.
Why These Work
The messages arrive on your phone, where your guard is often lower than at a computer. They reference organizations you actually use, making them feel relevant. And the link, which is designed to look like a legitimate URL, is often only one character different from the real thing, something almost impossible to notice on a small screen.
How to Protect Yourself
- Do not tap links in unsolicited texts, even if the sender appears legitimate.
- Go directly to the company’s official app or website to check on any claim made in a text.
- Look carefully at the URL before tapping. One wrong character means a fake site.
- If you’re unsure about a delivery notification, use the tracking number on the carrier’s official website directly.
- Forward suspicious texts to 7726 (SPAM). This reports them to your carrier.
- Block the number and delete the message if you’ve confirmed it’s a scam.