A smishing scam is a fraudulent text message designed to make you tap a link, call a number or send money. Most impersonate a courier, a bank, HMRC or a relative and create urgency so you act before you think. Spot one by checking the sender, the pressure applied and where the link really goes, then report it to 7726.
Scam texts are now the most common way UK adults encounter fraud. Ofcom's 2026 research found that 40% of mobile users had received at least one suspicious message in a three month period, and operators block more than 600 million scam messages a year before they reach a handset. Plenty still get through and this guide covers the smishing scams circulating in the UK right now, the signs that give them away, how to report them and what organisations should do to stop a scam text on a personal phone turning into a breach at work.
If you want the background first, read what is smishing? SMS phishing explained, this article is the practical companion to it.
What are the most common smishing scams in the UK right now?
Scam texts follow fashions, so when a brand or a news story is on everyone's mind, the criminals borrow it. The formats below account for most of what is reported to 7726 and to consumer groups such as Which?, and each has a recognisable tell.
The parcel that cannot be delivered
A message claiming to be from Evri, Royal Mail, DPD or DHL says the driver could not deliver because of missing address details or an unpaid customs or redelivery fee. Which? highlighted an Evri variant in 2025 that asks you to reply Y to activate a link, which is a trick to get past link filters and confirm your number is live. The tell is that genuine couriers do not charge redelivery fees by text and already have your address.
The HMRC refund
A text says you are due a tax rebate and links to a form that asks for your bank or card details to "process" it. HMRC does not notify refunds by text and never asks for payment details by SMS, any tax refund is handled through your online account or by letter.
The bank security alert
The text warns of a new payee, a login from a new device or a suspicious payment and gives a number to call or a link to "cancel" it. Some are timed to land in the same thread as genuine bank messages by spoofing the sender name. Your bank will never ask you to move money to a safe account, share a full password or read out a passcode.
The failed payment
A message impersonating a mobile network, broadband provider or energy company says a payment has failed and service will be suspended unless you update your card. Which? reported an EE version of this in 2025 that led to a copycat billing page.
"Hi Mum" and the family emergency
A message from a new number claims to be a child who has lost or broken their phone. After a few friendly exchanges comes the request: An urgent bill, a rent payment, a locked bank account. A related version skips the pretence and simply says a family member is in hospital and needs money. These succeed because they target love and panic rather than a brand.
The prize, the job and the investment
Texts offering a competition win, a part time job paying suspiciously well or a guaranteed return on cryptocurrency. The link leads to a form that harvests personal details, or to a conversation that eventually asks for a "registration fee".
The workplace text
A message apparently from your CEO asking for a quick favour while they are in a meeting, a "Microsoft" alert saying your password expires today or an IT department text asking you to confirm a multi-factor authentication code you did not request. These are the smishing scams that matter most to IT teams, because the target is not a personal bank account but a corporate login.
How do you spot a smishing text?
Criminals rely on you reacting to the content of the message rather than examining the message itself. Slowing down for ten seconds and asking the following questions defeats the large majority of scam texts.
Were you expecting it? Genuine organisations rarely text out of the blue about problems that need immediate action. A parcel you did not order, a refund you did not claim or a payment you did not make is a strong sign.
Is it pushing you to act now? Deadlines measured in hours, threats of suspension, fines or prosecution and emotional pressure about a family member are the standard tools of a scam text. Legitimate organisations give you time and a way to check.
Who is it really from? An unknown mobile number, an international number or a sender name that is slightly different from previous genuine messages should stop you. Remember that sender names can be spoofed, so even a familiar name in the thread is not proof.
Where does the link go? Look for shortened URLs, misspelt brand names, extra words in the domain (such as royalmail-redelivery) and unusual endings. On a phone you can press and hold a link to preview the full address without opening it. If you are unsure, do not open it at all.
What is it asking for? No genuine organisation asks for a full password, a PIN, a passcode from your authenticator app or a payment to release a parcel by text. Any request for those is a scam by definition.
Does the wording feel right? Errors in spelling and grammar, odd capitalisation, a generic greeting such as "Dear customer" or formatting that does not match a company's normal messages are all signs, though well funded scams increasingly get these details right.
If two or more of these apply, treat the message as a scam and verify through a channel you already trust: the organisation's official app, the number on the back of your card or the tracking reference you already hold.
What happens if you click a link in a smishing text?
Tapping the link is usually not the moment the damage happens, but it is the moment the criminal gains control of what happens next. Most links lead to a copycat website that asks you to log in or enter card details. Everything you type goes straight to the attacker, who will typically use it within minutes, often while sending you a follow up text asking for the one-time passcode your bank has just sent, so they can complete the login or payment they are making in your name.
Some links download malware, most commonly on Android devices, which can then read incoming texts, capture banking app credentials or send further scam messages to your contacts. Others simply record that you clicked, which marks your number as responsive and leads to more texts and calls.
For an employee, the worst case is entering Microsoft 365 or another work login on a fake page. With that password and an intercepted passcode, an attacker can read email, reset other accounts and launch convincing attacks on colleagues from a genuine internal address. This is why smishing on personal phones is a corporate security issue rather than a personal inconvenience.
How do you report a smishing text in the UK?
Reporting takes seconds and makes a real difference, because the information lets mobile operators block the numbers and links involved.
The free reporting routes recommended by the NCSC and Ofcom, and what to do if money or details have been lost.
Forward the text to 7726
7726 spells SPAM on a keypad and the service is free on all major UK networks. On an iPhone, press and hold the message, tap More, select it, tap the forward arrow and enter 7726. On Android, press and hold the message, tap the three dots, tap Forward and enter 7726. Your network may reply asking for the sender's number, which you can copy and send back.
Report it to the organisation being impersonated
Most banks, couriers and government departments have their own reporting route. HMRC asks you to forward tax scam texts to 60599 (charged at your normal network rate) and suspicious HMRC emails to phishing@hmrc.gov.uk. If the same scam arrived as an email rather than a text, forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk.
Contact your bank if you shared details or paid
Call the number on your card or dial 159, the Stop Scams UK service that connects you to your bank's fraud team. Banks can stop payments and cancel cards if told quickly.
Report any loss to Action Fraud
In England, Wales and Northern Ireland report to Action Fraud on 0300 123 2040 or at reportfraud.police.uk. In Scotland, report to Police Scotland on 101. Then delete the text.
At work, report any suspicious text that mentions your employer, your IT department or your work accounts to your IT or security team, even if you are not sure. One report can be the early warning that a whole department is being targeted.
What should you do if you have already responded to a scam text?
Act in this order: First, if you entered card or bank details, call your bank straight away using the number on your card or by dialling 159, the Stop Scams UK service that connects you to your bank's fraud team, they can stop payments and cancel cards. Second, if you entered a password, change it immediately on that account and on any other account where you used the same password and switch on multi-factor authentication. Third, if the login was for a work account, tell your IT team the same day so they can check for unusual sign ins and revoke sessions. Fourth, if you downloaded anything, run a security scan or, on a work device, hand it to IT. Finally, report the scam to Action Fraud so the pattern is recorded.
Do not feel embarrassed, these scams are designed by professionals to beat sensible people and the NCSC's guidance to organisations is clear that blaming people for clicking does not work and only discourages the reporting that limits the damage.
How can organisations prevent smishing attacks on staff?
Technology helps less here than with email, your email gateway, link scanning and report button never see a text on an employee's personal phone. What you can control is the strength of your authentication, the clarity of your policies and the judgement of your people.
Start with authentication: Enforce multi-factor authentication on every account that can be reached from the internet and prefer phishing-resistant methods, such as passkeys or hardware keys, for administrators and finance staff, so that a stolen password and a stolen passcode are not enough on their own. Make it a written rule that no one in IT will ever ask a member of staff for a passcode by text or phone, and tell staff that clearly, so any such request is instantly recognisable as a scam.
Then work on behaviour: Boxphish's cyber security awareness training covers social engineering and impersonation, including text and voice based scams, in short video and quiz based modules that teach the patterns above rather than a list of last month's scam texts. The content follows NCSC guidance and is updated as threats change, and it can be delivered inside Microsoft Teams so staff complete it without leaving the tools they already use.
Reinforce it with phishing simulations that build the habit of pausing and verifying under realistic pressure, and measure the result. Analysis of more than 400,000 Boxphish platform users found that untrained users are 8.8 times more likely to click a phishing link than trained users, and the platform's analytics show you which teams and locations still carry the most risk so you can target follow up training where it matters. That closed loop of assess, educate, reinforce and measure is the practical core of human risk management.
Finally, make reporting easy and safe: Give staff one obvious place to report a suspicious text, thank them when they do and share anonymised examples of what was reported so the whole organisation learns from each attempt.
Smishing scams in summary
Scam texts work by borrowing a trusted name and adding pressure. The current UK favourites are missed parcels, HMRC refunds, bank alerts, failed bills and "Hi Mum" messages, with a growing set aimed at employees' work logins and passcodes. Spot them by asking whether you expected the message, whether it is rushing you and where the link really leads. Report them to 7726, verify through official channels and, if you run an organisation, train your people to do the same.
To see how Boxphish helps UK organisations turn staff into a reliable defence against smishing and every other form of social engineering, book a demo.
Frequently asked questions
What is the most common smishing scam in the UK?
Fake parcel delivery texts impersonating Evri, Royal Mail, DPD or DHL have been the most reported smishing scam for several years, according to UK Finance data cited by the NCSC. HMRC refund texts, bank security alerts, failed payment texts from mobile and energy providers and the Hi Mum family scam are the other regulars.
Can you get scammed just by opening a text?
Opening and reading a text is safe on a modern phone. The risk comes from tapping a link, replying, calling a number in the message or downloading an attachment. Even replying STOP confirms your number is active, so the best response is to report the text to 7726 and delete it.
What happens if I click a link in a scam text?
Usually you land on a copycat website that asks you to log in or enter card details, which go straight to the criminal. Some links download malware, particularly on Android. If you clicked but entered nothing, you are probably fine. If you entered details, change your passwords, contact your bank and tell your IT team if a work account was involved.
Does forwarding a text to 7726 cost anything?
No. 7726 is free on all the major UK mobile networks. The report goes to your network provider, which uses it to identify and block the numbers and links used by scammers. You do not need to add any comment, and you can report scam call numbers to 7726 as well.
How can a business stop smishing attacks on employees?
Enforce multi-factor authentication, preferably phishing-resistant methods for privileged accounts, tell staff clearly that IT will never ask for a passcode by text or phone, make reporting easy and blame free, and run regular cyber security awareness training and phishing simulations so staff recognise the pattern rather than a single scam.
