What Is a Phishing Link or Text? Smishing Explained

What is a phishing link or phishing text? Learn how to check links safely, spot smishing scams, what to do if you clicked and how to report spam texts to 7726.

What is a phishing link? A phishing link is a web address in a message, ad or QR code that opens a fake page built to steal passwords, card details or one-time codes, or to install malware. What is a phishing text? It is a text or chat message, known as smishing, that delivers such a link.

Below: how phishing links are disguised, how to check one safely, what is smishing and phishing and how they differ, common smishing themes, what to do if you clicked, and how to report spam texts in the US and the UK.

What is a phishing link?

A phishing link points somewhere other than where it claims to go. The visible text might say "Track your parcel" or "Verify your account", but the real destination is a site controlled by criminals, usually a cloned copy of a familiar login or payment page. Common disguises include:

• Lookalike domains that swap or add a character, such as examp1e.com or example-support.example instead of example.com. See typosquatting and homoglyph domains explained.
• Brand names in the wrong place, such as example.com.account-check.example, where the real domain is the part at the end, not the beginning.
• Link shorteners that hide the destination behind a short, meaningless address.
• Mismatched link text, where the words you see differ from the address the link actually opens.
• QR codes, which hide the destination entirely until you scan them.

For what to look for once a page has loaded, see how to spot a phishing website.

How to check a link without clicking it

Use one or more of these checks before opening anything.

Hover on a computer

Rest your pointer over the link without clicking. Most browsers and email apps then show the real destination. If it does not match the company the message claims to come from, do not click.

Long-press carefully on a phone

Pressing and holding a link on a phone usually reveals the address. Be aware that some phones then show a live preview, which loads the page. A safer habit is to choose "Copy link" and paste it into a notes app to read it.

Read the domain from right to left

Find the first single slash after https://; the domain ends just before it. Read backward from that point: the last two parts (or three, for addresses such as example.co.uk) tell you who owns the site. In https://login.example.com.verify-account.example/, the site belongs to verify-account.example, not to example.com. Everything further left is just a label the owner chose.

Expand shortened links

For a shortened link, a URL expander service can reveal the full address without opening the destination page. Treat a shortened link in an unexpected message as a warning sign in itself, since real banks and couriers usually link to their own domains.

Check its reputation

Tools such as Google's Safe Browsing site status or VirusTotal show whether a URL has already been flagged. A clean result does not prove a link is safe, because new phishing pages are often only hours old.

Or skip the link entirely

The most reliable check is not to use the link at all. Open the company's official app, or type its address yourself, and look for the alert there. If the message was real, you will see the same notice.

What is a phishing text (smishing)?

A phishing text, or smishing (SMS phishing), is a scam message sent by SMS, RCS, iMessage or a chat app such as WhatsApp. It impersonates a company, government office or even a family member, and pushes you to tap a link, call a number or reply with information.

People tend to trust texts and act on them quickly. Sender names can also be spoofed, so a scam text may appear in the same thread as genuine messages from that company.

Common smishing themes

• Parcel delivery. "Your package is on hold; pay a small redelivery fee." The payment page captures card details and the bank's one-time code. More in fake parcel-delivery SMS scams.
• Bank alerts. A "suspicious payment" or "account locked" warning linking to a fake login, often followed by a call from a fake fraud team.
• Unpaid road tolls. The FBI's Internet Crime Complaint Center has warned about smishing texts claiming unpaid road toll debts and advises checking your account only through the toll service's official website.
• Tax refunds and penalties. In the US, the IRS says it does not send text messages without your permission and asks people to report fakes to phishing@irs.gov and forward them to 7726. In the UK, HMRC says it will never notify you of a tax rebate by text and asks people to forward suspicious texts to 60599, as explained on GOV.UK.
• Family emergencies. "Hi Mum, I've lost my phone, this is my new number," followed by an urgent request for money.

What is smishing and phishing? The key differences

Phishing is the broad category: any attempt to trick you by impersonating a trusted party. Smishing is phishing delivered by text. The goals are the same; the differences are in the channel:

• Less to inspect. A text has no email headers, and phone screens often truncate links.
• Fewer filters. Work email usually passes through security filters; personal phones often do not.
• Shorter and more urgent. Texts suit one-line pressure messages and small payment requests.
• Often combined with calls. A text may ask you to ring a "fraud line", turning smishing into vishing (voice phishing).

For the full picture of phishing types, read what is phishing.

What to do if you clicked a phishing link or text

1. Stop and close the page. Do not enter anything else.
2. If you entered a password, change it on the real site, which you open yourself, and anywhere you reused it. Turn on multi-factor authentication.
3. If you entered card details or a one-time code, call your bank using the number on your card or its official app and block the card.
4. If you installed an app from a link, remove it, run a security scan and check which apps have permission to read messages or control your device.
5. Watch for follow-up contact. Scammers often call shortly afterward, pretending to be your bank's fraud team.
6. Report it using the steps below.

How to report spam and phishing texts

In the United States

• Forward the text to 7726 (SPAM). The FTC explains in its guide to recognizing and reporting spam texts that this helps your wireless provider block similar messages.
• Use your messaging app's report option. On iPhone, messages from unknown senders show a "Report Junk" option, as described by Apple Support. In Google Messages, touch and hold the conversation, then tap Block and Report spam, according to Google's help page.
• Report it to the FTC at ReportFraud.ftc.gov.

In the United Kingdom

• Forward the text to 7726. The NCSC says most phone providers let you report suspicious texts free of charge this way.
• If you lost money or shared details, contact your bank and report it to Report Fraud (England, Wales and Northern Ireland), which replaced Action Fraud in December 2025, or call Police Scotland on 101.

Elsewhere, ask your mobile operator how to report spam and check your national CERT or consumer protection authority. For more channels, see how to report a scam and how to report a scam website.

Reporting the text helps block the sender. Getting the website taken down protects everyone who receives the same link. If a text led you to a fake site, report a phishing site to Phishvoid. If your brand is being impersonated in smishing campaigns, book a free exposure scan to see which lookalike domains are live and how quickly they can be removed.

FAQ

Can you get hacked just by opening a text message?

For most people, simply reading a text is low risk. The danger is tapping links, installing apps or replying with information. Keep your phone's software updated to close rare security flaws.

Should I reply "STOP" to a scam text?

No. Replying to a suspicious message confirms your number is active. Report it, block the sender and delete it instead.

Is it safe to open a link just to see if it is real?

No. Some phishing pages try to install malware or capture data as soon as they load. Check the address without opening it, or go to the official site yourself.

What happens when I forward a text to 7726?

In the US and the UK, 7726 goes to your mobile provider's spam reporting system, which can investigate the sender and block similar messages.

How can a company stop smishing that uses its name?

Monitor for lookalike domains, warn customers about how you do and do not contact them, and have the phishing sites behind the texts reported to hosts, registrars and browser blocklists quickly.