How to Spot a Scam Text Message in Australia: Smishing Red Flags and What to Do

Almost everyone in Australia has received one: a text about a missed parcel, a toll you supposedly owe, or a bank account about to be closed. Most are scams, known as smishing, designed to make you tap a link before you think. The good news is that scam texts follow patterns, and once you know them, most are easy to spot.

This guide walks through the red flags, the checks you can run in under a minute, and what to do if you already tapped a link or shared details.

What smishing is and why it works

Smishing is phishing by text message. A scammer sends a message pretending to be from a delivery company, a bank, a government service such as myGov or the ATO, or a well-known brand. It usually carries a link to a fake website that looks like the real one, where you are asked to enter personal details, log in, or pay a small fee.

It works because texts feel personal and urgent. A message lands on the same screen as notes from family and friends, and the scammer counts on you reacting before you check. The goal is rarely the small fee in the message. It is your login, your card number, or enough detail to impersonate you later.

Scammers can also fake the sender name, so a message can appear to come from a bank or a delivery company even when it was sent from a bulk messaging service. The sender name alone is never proof a message is genuine.

Red flag 1: an unexpected link

The most reliable warning sign is a link you were not expecting. Real couriers do send tracking messages, but only after you have ordered something and given them your number. A text about a parcel you never ordered is a scam.

The same applies to tolls, fines, and refunds. No recent toll road trip means a toll message is fake, and no expected refund means a refund message is fake. When in doubt, ask one question: did I expect this message? If the answer is no, do not tap the link.

Red flag 2: urgency and threats

Scam texts almost always create a deadline: your account closes today, your parcel returns tomorrow, your licence is suspended unless you pay now. The urgency is deliberate, pushing you to act before you check.

Real organisations rarely threaten to shut down your account within hours over a text link. If a message makes you feel rushed, treat that as a signal to slow down, not speed up.

Red flag 3: a request for personal details or payment

Banks, myGov, the ATO, and delivery companies do not ask you to confirm your password, card number, or identity through a link in a text. A message that asks you to log in, update your details, or pay a fee through a link is almost certainly a scam.

Watch for odd web addresses too. A link might look close to a real one but use a strange ending or a shortened link that hides where it goes. On most phones you can press and hold a link to preview the address without opening it. If it does not match the organisation's real website, delete the message. Watch for spelling mistakes and a greeting like "Dear customer" instead of your name. One typo proves nothing, but several small tells together should raise your guard.

How to check a suspicious text in under a minute

First, do not tap the link and do not reply. Replying tells the scammer your number is active, which can bring more scam messages.

Second, check the claim through a channel you trust. If the text claims to be from your bank, open your banking app. If it claims to be about a parcel, check the tracking number in the courier's app. If it claims to be from myGov, open the myGov app or type my.gov.au into your browser. Never use the link in the message to check the message.

Third, look for the same message in the app. A real delivery update usually shows in the courier's app, and a real bank warning usually appears inside your banking app. If the claim exists only in one text, that is a strong sign it is fake.

What to do if you already tapped or replied

If you tapped a link but entered nothing, close the page and delete the message. If you entered a password, change it right away from the real website or app, and change it anywhere else you used it.

If you entered card details, call your bank on the number on the back of your card and ask them to watch or block the card. Calling quickly gives them the best chance of stopping a fraudulent charge.

If you shared identity details such as your licence or Medicare number, contact IDCARE on 1800 595 160 for free advice. You can also report the scam to Scamwatch at scamwatch.gov.au and forward the text to 0429 999 888.

How to report and block scam texts

On an iPhone, open the message, tap the sender name or number at the top, and look for the option to report junk in most recent versions. On Android, open the message in the Google Messages app, tap the three dots, and choose block or report spam. Steps vary a little between models, so check your phone maker's support pages if you cannot find the option.

Forward scam texts to 0429 999 888 to help authorities track which scams are spreading.

Frequently Asked Questions

How can I tell if a delivery text is real?

A real delivery text only arrives after you have placed an order and given the courier your number. Check the tracking number in the courier's own app or website instead of tapping the link.

What is the number to report a scam text in Australia?

Forward the scam text to 0429 999 888, or report it to Scamwatch at scamwatch.gov.au. If you shared card details, call your bank first, and if you shared identity documents, contact IDCARE on 1800 595 160.

Can a scammer fake the sender name on a text?

Yes. Scammers can make a message appear to come from a bank, a delivery company, or a government service by spoofing the sender ID. That is why the sender name alone is never proof a message is genuine.