Smishing scams: How to spot fake text messages

Smishing, short for SMS phishing, is a phishing scam that uses fake text messages to trick you into sharing personal or financial information like passwords or credit card numbers. These messages often appear to come from trusted companies, like your bank, parcel delivery services, or your broadband provider.  

Like other types of phishing scams, like email phishing, smishing messages typically include a malicious link leading to a fake website. These scams don’t only come through traditional SMS, they also appear on data-based messaging apps like WhatsApp, Telegram, and Facebook Messenger. 

Smishing messages come in different forms. Here are some of the most common tactics to be aware of: 

Smishing messages can be surprisingly convincing, but there are some common red flags and smart habits that can help you stay protected. Here’s what to look out for: 

Watch for vague or generic greetings

Scammers often don’t know your name, so they’ll use vague greetings like: 

• “Dear customer” 

• “Hello user” 

• “Hi there” 

Banks, government agencies, and legitimate companies like us will usually address you by your full name or account holder name. We will never request personal info over a text message.

Look for poor spelling or grammar mistakes

Professional companies rarely send messages with typos. These messages often indicate automated or non-native English sources. If you notice: 

• Misspelled words 

• Awkward phrasing 

• Poor punctuation 

…it’s a strong indicator that the message is fraudulent.

Urgent or threatening language

Smishing texts often try to create panic or urgency to get you to act without thinking. Watch out for phrases like: 

• “Act now to avoid disconnection.” 

• “Your account will be suspended."

• “Immediate action required."

These are pressure tactics designed to override your better judgment.

Be cautious of suspicious of shortened links

Scam texts usually include a link that leads to a fake website. These links might: 

• Look similar to a real URL but with subtle differences (e.g., virginmedia-billing.com) 

• Use URL shorteners to hide the destination 

• Ask you to log in or enter payment details 

Tip: On some phones, you can press and hold the link to preview it without clicking. 

Requests for personal or financial information

No legitimate company will ask for sensitive information via text. Be cautious if a message asks for: 

• Passwords 

• Bank details 

• National Insurance numbers 

• Security codes 

If in doubt, contact the company directly using a verified method. 

Tip: Virgin Media will never ask for sensitive information via text. If in doubt, don’t click. Instead, go directly to the official website or app.

Keep your phone secure

Stay protected by making your device harder to exploit: 

• Enable spam and scam filters on your phone or via your mobile network 

• Avoid clicking links in messages from unknown numbers 

• Install a trusted security app to detect threats 

• Keep your phone’s software up to date to close security gaps 

• Don’t store banking or card details on your phone unnecessarily 

• Don’t share your mobile number publicly: on social media, for example

If you’ve clicked a suspicious link or shared personal information with the scammer, don’t panic. Acting quickly can help you regain control and limit any potential damage. Here are some things you can do: 

• Start by changing all your passwords and PINs immediately, prioritising your bank and email accounts. Be sure to use strong, unique passwords and enable two-factor verification wherever possible for added security. 

• Contact your bank or credit card issuer to alert them to the situation and freeze your account or flag suspicious activity. They’ll try to recover any money you’ve lost. You can call 159 to connect directly to most UK banks.  

• Forward fraudulent SMS texts to us at 7726 (which spells “SPAM” on a keypad), and we’ll look into them (it won’t cost you anything), and it means we can investigate the sender 

• If your phone supports SPAM reporting (currently available if you have an Android device using the Google Messenger App, but others will be available soon), then press the SPAM button to automatically forward the message to 7726

• If you’ve shared personal information or clicked on a suspicious link, ring Action Fraud, the UK’s national reporting centre for fraud and cybercrime, on 0300 123 2040 or use their online reporting tool.  

• Finally, run a malware scan on your phone device to check for any malicious software that may have been installed as a result 

Virgin Media Advanced Security powered by F-Secure, can boost your protection by blocking SMS scams automatically with the latest AI technologies and avoiding malicious sites and links before you land on them.  

Download Virgin Media Advanced Security on all your devices to get going, including smartphones, laptops, tablets, and desktop PCs. We won’t ask for any payment info, so you don’t need to worry about sneaky auto-renewals or unexpected bills. After that, if you’d like to continue, it’s just £3 per month (or £30 a year).