How to Spot a Fake SMS? What Smishing Is and 7 Warning Signs

A text arrives: "Your package is on hold, pay a R$ 7.90 fee to release the delivery." The sender looks legitimate, the message is urgent and the link is short. Ten seconds later, someone has typed their card number into a site that imitates the Brazilian postal service. That is smishing — phishing by SMS — and it keeps working because the message lands in the same place where you receive your bank's verification codes.

What smishing is

What is smishing?

Smishing is a phishing scam delivered by text message (SMS): the scammer poses as a bank, courier, carrier or government agency and tries to get you to click a fake link or hand over data.

The name comes from "SMS" + "phishing". The logic is the same as email phishing, but the channel changes the game: your phone has no decent spam filter for SMS, the screen is small (the full link address stays hidden) and people still treat SMS as an "official" channel.

How the scam works under the hood

The typical flow has four steps:

1. Mass sending: the scammer sends thousands of messages, often through bulk-sending systems or even rogue cell towers. According to Tecnoblog, Brazilian police and Anatel (the telecom regulator) have already seized fake antennas used for this.
2. Bait with urgency: a held parcel, a blocked account, points about to expire, a fine, "suspicious activity".
3. Cloned page: the link leads to a site that looks like the original, hosted on a freshly registered domain or hidden behind a URL shortener.
4. Collection: you type your ID number, password, card data or the code received by SMS — and the scammer uses it right away, on the real app.

One important technical detail: the name shown as the sender can be forged. In many cases the fake message lands in the same conversation as the bank's legitimate messages, which gives a false sense of trust. Seeing the contact's history does not prove the message is real.

7 signs the SMS is fake

1. Urgency with a short deadline ("fix it within 24 hours").
2. A small fee to release a parcel. According to Estado de Minas, Correios does not charge fees to release parcels by SMS.
3. A shortened link or odd domain (swapped letters, strange suffixes, the brand name buried in a long address). See also the swapped-letter scam.
4. A request for data or payment by message. A bank does not ask for profile updates or payments by SMS.
5. A request for a verification code ("reply with the code we sent you"). That code is the key to your account.
6. A generic message, without your name and without any detail only the company would know.
7. A regular mobile number instead of an official channel, or a request to contact an unknown WhatsApp number (a variant of the "Hi, Mom" scam).

What to do when you get a suspicious SMS

Can I open the link just to see what it is?

Ideally, don't. Just tapping the link can confirm to the scammer that your number is active and, depending on the device and the site, expose you to data-theft pages or malicious app downloads. If you need to verify the information, leave the message and go straight to the official app or type the site address in your browser.

• Don't reply or send "STOP": that confirms the number exists.
• Confirm through an official channel: the bank app, a hand-typed site address, the phone number printed on your card.
• Block the sender and delete the message. Report it to your carrier through its channels.
• Enable strong authentication: with app-based 2FA (TOTP) or passkeys, a code stolen over SMS is worth far less.

What if I already clicked or typed my data?

Act within the first minutes:

1. If you typed a password, change it on the real site/app and anywhere else you reuse it.
2. If you entered card details, block the card in your bank app and request a new one.
3. If you handed over a verification code, end the account's active sessions and review recent access.
4. If a Pix payment (Brazil's instant payment system) went out, call the bank immediately and ask it to trigger the MED (Special Refund Mechanism).
5. If you installed an app from the link, uninstall it and follow the guide on how to tell if your phone has spyware.

Does Anatel's new rule help?

On November 4, 2026, Anatel published rules in the Official Gazette requiring carriers to block corporate SMS sent from unregistered short codes. The rule provides for a public registry of senders, with each code tied to a company, and automatic monitoring of suspicious activity, with deadlines of 60 to 90 days (extendable), according to Tecnoblog.

It is progress, but it does not solve everything: the text itself acknowledges that smishing remains possible and that rogue antennas can send messages without going through the carriers' systems. Being in the registry also does not guarantee a message is safe. The defense is still the habit of not clicking and checking on your own.

The bigger lesson

No legitimate message needs you to decide in 30 seconds, through its own link. Rule of thumb: SMS with a link and urgency = verify elsewhere, always. To go deeper, read how the social engineering attack no antivirus can block works — it is the basis of every message scam — and share this post with anyone who still clicks on a "release fee".