Smishing: SMS phishing scams
Smishing uses text messages to trick people into clicking malicious links or calling fraudulent numbers. Over 100 million suspicious texts were reported to 7726 in the year to April 2025, and Ofcom estimates half of all UK mobile users received a suspicious message in the preceding six months.
What is smishing?
Smishing combines “SMS” and “phishing”. Fraudsters send text messages that appear to come from banks, delivery companies, HMRC, the DVLA, or other trusted organisations. The messages typically contain a link to a fake website that harvests your details, or a phone number that connects to a scammer.
Modern smartphones can group texts by sender name rather than number, meaning a smishing text can appear inside an existing conversation thread with your bank, if the scammer uses the same sender ID. This makes them significantly harder to spot.
Forward to 7726: free on all UK networks
Forward any suspicious text message to 7726 (which spells SPAM on a phone keypad). This is free on EE, O2, Three, Vodafone and all other UK networks. Your provider will investigate and can block the sender. You may receive a follow-up asking for the sender's number.
Common smishing texts in the UK
Fake Bank text
"HSBC: Unusual activity detected on your account. Your card has been temporarily suspended. Verify your details immediately: [link]"
Fake HMRC text
"HMRC: You are owed a tax rebate of £342.50. Claim your refund at: [link] — offer expires in 24 hours."
Fake Royal Mail text
"Your parcel could not be delivered. A redelivery fee of £1.99 is required: [link]"
Fake DVLA text
"DVLA: Your vehicle tax expires soon. Renew immediately to avoid a £1,000 fine: [link]"
Fake NHS text
"NHS: You have been selected for a free health screening. Book your appointment now: [link]"
Fake Council text
"Your council tax account is overdue. Pay now to avoid enforcement action: [link]"
Fake Parcel / courier text
"DPD: Your parcel is on hold due to an unpaid customs fee of £2.49. Pay here: [link]"
Warning signs in a text
- ✗Urgency: "act now", "expires today", "immediate action required"
- ✗A link that does not match the organisation's real domain (check carefully, as scammers use lookalike URLs)
- ✗Requests for payment via a link (HMRC, DVLA, Royal Mail never do this)
- ✗Asking you to call a number included in the text
- ✗Slightly wrong sender name, for example "HMRC-UK", "RoyalMaiI" (capital i instead of l)
- ✗Any text you were not expecting, even from a familiar sender name
What to do
- ✓Do not click any link in the text. If you think it might be real, go directly to the organisation's website by typing it manually.
- ✓Do not call any number included in the text. Look up the genuine number on the organisation's official website.
- ✓Forward suspicious texts to 7726, free on all UK networks.
- ✓Report to Action Fraud at reportfraud.police.uk or 0300 123 2040.
- ✓If you clicked a link and entered details, contact your bank immediately.
- ✓If you entered card details, ask your bank to cancel and reissue the card.