Nano-lesson · usually takes 2–3 minutes
Smishing — fake text messages
Parcel, bank and eID texts designed to trick you — know the trick.
"Your parcel is waiting"
"Your parcel is waiting — pay £1.50 in customs fees." Sound familiar? Most people have had one. Smishing is fraud by text message: the message looks like it's from the post office, your bank or your eID provider, and the link leads to a fake page.
Typical messages
- "Your parcel is waiting — pay a small fee here." (fake Royal Mail/customs)
- "Suspicious activity on your account — verify with your eID."
- "Earn easy money from home" — fake job and task offers are the most common bait.
Where does the link actually lead?
https://
Domaineid-verify-secure.com
/confirmPath
- Protocol
- The way the page is retrieved (http or https).
- Domain
- The actual place the page lives. This is the part you need to read.
- Path
- The specific page on the domain.
A text link might point to eid-verify-secure.com — that is not your real eID provider. Your eID provider never asks you to log in via a link in a text message.
How to spot it
- Unexpected — you weren't expecting a parcel, a bill or a message from the bank.
- Urgency — "by end of day", "account will be blocked", "last chance".
- Asks for login or payment — password, eID, card number or a "small fee".
- The sender name means nothing — anyone can write "Royal Mail" as a sender name in a text; it can be spoofed.
New tricks right now
- "Wrong number" — a friendly stranger writes "is this Sarah?" and draws you into a conversation that ends in fake investments.
- QR codes — a text (or a physical letter) with a QR code leads to the fake page, bypassing filters.
- "Your parcel could not be delivered — rebook a time" is the most widespread one right now.
Do
never click links in unexpected texts. Go into the app yourself or type the address into your browser. Your bank and eID provider never ask you to log in via a text link.
Remember
What the research says
Losses to text scams hit $470 million (over £370 million) in 2024 — 5× the 2020 level — even though fewer people report it (meaning the true cost is even higher). The most common lures are fake parcel messages, fake job/"task" offers, and fake road tolls.
Question 1 of 3
You're actually expecting a parcel — and then the text arrives: "Your parcel is awaiting customs clearance: pay £1.50" with a link. What do you do?
✓ Correct!
Scammers send these messages blind — the fact that you happen to be expecting a parcel is just the coincidence they're counting on. Replying (even "STOP") just tells them the number is active. Check the parcel through your own channel instead.
Question 2 of 3
Text: "Suspicious activity — verify with your eID" with a link. What do you do?
✓ Correct!
Your eID provider and bank never ask you to log in via a text link — and both the padlock icon and sender number can be faked by scammers. Always go in through your own channel.
Question 3 of 3
A new text lands in the same thread as your genuine messages from "Royal Mail". Does that mean it's real?
✓ Correct!
Scammers can set any sender name they like on a text message — so your phone automatically groups it with the genuine ones. Never judge a text by its thread or wording; go into the app yourself instead.
Well done!
You've completed one of the foundation courses — the ones everyone gets for free.
With a free login:
- Your points, progress and course certificate are saved.
- You get courses tailored to your role — not just the foundation courses.
- We send training exactly when you need it — for example, as a follow-up to a phishing test.