An unexpected bank or delivery text can look convincing, especially when it mentions a payment, parcel, toll, or locked account. This reusable checklist explains how to decide whether a message is legitimate without tapping its link, replying, or sharing sensitive information.
Overview
Texts that impersonate banks, parcel carriers, toll services, payment providers, and online retailers are commonly called smishing messages: phishing delivered by SMS or another messaging service. The message may claim that a payment failed, a package needs a small fee, an account will be suspended, or suspicious activity requires immediate confirmation.
The safest first response is to pause. Do not use the phone number, link, QR code, or instructions supplied in the message to investigate the claim. Instead, open the organization’s official app by using the icon already installed on your device, type the known website address yourself, or use a trusted contact method from a statement or physical card.
A familiar logo, a local-looking number, or details about a real purchase do not prove that a text is genuine. Treat the message as unverified until the same alert appears through a trusted channel. If there is no matching notification in your bank or carrier account, that is useful context, although you should still check directly if the claim involves money or account access.
Checklist by scenario
Use the relevant checklist below before taking any action. A single warning sign may be enough to stop and verify independently; several together should be treated as a strong phishing scam warning.
Bank or card alert
- Do not tap links that ask you to confirm a payment, unlock online banking, or “secure” your account.
- Open your bank’s official app or type its known web address manually. Review recent transactions and in-app alerts.
- Call the number printed on your bank card or shown on an official statement, not the number in the text.
- Never disclose a password, PIN, full card number, or one-time verification code to someone who contacted you unexpectedly.
- If you see an unfamiliar transaction, use the bank’s documented fraud-reporting process while keeping the suspicious text available as evidence.
Parcel delivery text
- Check whether you are actually expecting a parcel and whether the carrier appears in your order confirmation.
- Find the tracking number in the retailer’s app, order email, or account rather than relying on the text.
- Visit the carrier’s official website by typing the address yourself or using its verified app.
- Be cautious of requests for a small redelivery fee, address confirmation, customs payment, or card details through a shortened link.
- If you are unsure, contact the retailer or carrier through a trusted channel and ask them to confirm the tracking information.
Account-lock or password message
- Do not sign in through the message link, even if the text says your account will be closed within minutes.
- Open the relevant service directly and check its security notifications, account status, and recent login activity.
- Change a password only through the official app or website. Use a new password that is not reused elsewhere.
- Review multi-factor authentication settings and recovery details if you believe you entered information on a suspicious page.
Toll, tax, refund, or payment message
- Verify the alleged bill through the official account connected to the service.
- Do not pay an unexpected balance through a text link, QR code, gift card, cryptocurrency, or unusual payment method.
- Be especially careful when a message promises a refund but asks you to “confirm” banking details or send money first.
- Look for the organization’s official contact information independently. Do not assume the message’s branding or telephone number is authentic.
Quick comparison
| Message type | Legitimate alert may do | Common scam signal | Safer verification |
|---|---|---|---|
| Bank | Provide a general notification or direct you to the secure app | Requests a one-time code, password, or urgent payment through a link | Check the bank app or call the number on your card |
| Parcel | Reference a shipment you recognize through a trusted tracking system | Unexpected fee, shortened link, or request for full card details | Check the retailer account or carrier website manually |
| Toll or tax | Identify a bill that can be found in an official account or letter | Threat of immediate penalties and payment through a text link | Use the official government or toll-service website |
| Account lock | Show a security notice inside the service after you sign in normally | Countdown language, unfamiliar login page, or demand for a code | Open the service directly and inspect security activity |
What to double-check
The sender. A sender name or number is not proof of identity. Message systems can display familiar labels, and a scammer may use a number that looks local or resembles a real organization. Treat sender information as a clue, not verification.
The link. Do not open a suspicious link simply to inspect it. Shortened URLs, misspellings, extra words, unusual domains, and links that do not match the claimed organization are warning signs. If you need to check a link safely, search for the organization independently or use a bookmark you created previously. A padlock or secure connection symbol alone does not establish that a site is genuine.
The pressure. “Act now,” “your account will close,” and “avoid a fee today” are designed to reduce careful thinking. Legitimate concerns can still require prompt attention, but urgency does not remove the need for independent verification.
The requested information. One-time codes are meant to confirm an action you initiated. They should not be handed to an unexpected caller or texter. Be cautious with requests for passwords, security answers, full payment details, identity documents, or remote access to your device.
The surrounding context. Ask whether the message matches something you actually did. Did you place the order? Is the alleged bank account yours? Does the claimed payment appear in your records? Context can expose a fake bank alert or parcel delivery scam, but never use a real coincidence as the only reason to trust a message.
For broader phishing checks, see our guide to spotting phishing emails and fake email examples. The same principles apply: pause, inspect independently, and avoid using contact details supplied by the suspicious message.
Common mistakes
- Replying with “STOP” or asking whether it is real. A reply can confirm that your number is active and may invite further contact. Use the messaging service’s reporting and blocking features instead, when available.
- Calling the number in the text. A scammer may answer while pretending to be bank or carrier support. Use a trusted number from your card, statement, official app, or independently located website.
- Searching only the exact wording. Other people may have reported similar text, but no search result can authenticate the specific message. Treat online reports as supporting evidence, not a replacement for direct verification.
- Clicking to see what happens. A page can collect data, imitate a sign-in screen, or prompt a malicious download. You do not need to open a link to decide that an unexpected message deserves caution.
- Sharing a verification code. If you requested a sign-in or payment confirmation, enter the code only in the official service you opened yourself. Never read it to an unsolicited caller or texter.
- Deleting evidence immediately. Save a screenshot that includes the sender, message, link, and time, but do not forward the link to others. Report the message through your carrier, messaging app, bank, or relevant organization using official routes.
If you already clicked, entered credentials, or sent money, act quickly: close the page, contact the affected bank or service through a trusted channel, change exposed passwords from a clean device if possible, and monitor accounts for unusual activity. Our post-scam recovery checklist covers additional steps when money has been sent.
When to revisit
Keep this checklist available for any unexpected alert involving money, delivery, login access, or identity information. Revisit it before major shopping periods, tax-related deadlines, travel seasons, and other times when genuine transaction messages are more likely and scam volume may increase.
The workflow is evergreen, but the details around it can change. Check your bank, carrier, payment provider, and mobile platform’s current in-app reporting and contact options twice a year. Update saved bookmarks and remove old phone numbers from personal notes. Publishers and editors should also refresh examples, carrier instructions, and official reporting routes before seasonal campaigns or whenever a major service changes its app or website.
When a new text arrives, use this five-step routine:
- Stop and do not tap, reply, call, or scan.
- Capture the message details for your records.
- Open the claimed organization through an independent, trusted route.
- Confirm the payment, parcel, or account issue there.
- Report and block the message if it is suspicious, then secure any information you may have exposed.
When in doubt, an independent check is faster and safer than trying to persuade a suspicious text to prove itself.
