SMS and WhatsApp Scams: How to Spot Fake Delivery, Bank and Prize Messages

A message arrives on your phone: "Your parcel could not be delivered because the address is incomplete. Tap here to update your details." If you really are expecting an order, this message is extremely convincing. You tap the link, a page that looks very much like the real delivery company's site opens, and you are asked to enter your card details for a small "redelivery fee".

This technique is called smishing (SMS + phishing), phishing by text message. The same traps are set through WhatsApp, Telegram, email and social media messages. In this guide we explain the most common scenarios, how to recognise fake messages and sites, and what to do if you have tapped a link.

The most common types of fake message

Fake delivery and customs messages

"Your parcel is held at customs, you need to pay duty", "Delivery failed, update your address." These are especially common in busy shopping periods.

Fake bank messages

"Your account has been suspended for security reasons", "A suspicious transaction was made with your card, tap to cancel it", "Your reward points are about to expire."

Fake government messages

Fake messages about tax refunds, unpaid tolls, traffic fines, benefits or support payments. "A tax refund of £245 has been issued in your name, tap to claim it."

Prize and lottery messages

"Congratulations! You've won an iPhone in our draw, just pay the shipping." There is no prize for a competition you did not know you entered.

Fake jobs and easy-money offers

"Earn £150 a day working from home", "Earn money just by liking products." These offers usually build trust with small payments first, then ask you to pay in money for a "task".

Messages that seem to come from someone you know

"Mum, my phone broke, this is my new number. I need to make an urgent payment, I'll explain later." In this scenario, the scammer pretends to be a relative.

How WhatsApp accounts get stolen

WhatsApp accounts are valuable to scammers: a hijacked account can be used to send messages asking everyone in the contact list for money.

• The verification code trap: "I sent you a 6-digit code by mistake, could you forward it to me?" That code is actually the verification code for setting up your WhatsApp account on another phone. The message often comes from a friend's account that has already been taken over.
• Fake support messages: "WhatsApp Support: your account will be closed, share the code to verify." WhatsApp does not write to you like this.
• Fake poll and giveaway links: Links shared in group chats that ask for login details.

8 ways to spot a fake message

1. Urgency and threats: "Within 24 hours", "your account will be closed", "last day." Real organisations do not rush you like this.
2. An unexpected win or debt: A prize, refund or fine you did not know about.
3. It contains a link: Organisations generally do not send links by text for payments or updating details; they ask you to go to their app or website.
4. A strange address: The link differs from the organisation's known address, for example something like "parcel-delivery-uk.xyz" for a delivery company.
5. Impersonal greeting: "Dear customer", or no greeting at all.
6. Spelling and language mistakes: Not always present, but a frequent sign.
7. Asking for card details, passwords or verification codes: These are never requested by message or through a form behind a link.
8. A foreign or odd number: International numbers, or "official" messages from ordinary mobile numbers.

How to spot a fake site

If you have tapped a link and a page has opened, check these before entering any information:

• Read the address bar carefully. Fake sites look very similar to the real address: swapped letters ("rn" instead of "m"), extra words ("-security", "-support", "-payment") or different endings (.xyz, .top, .online).
• The padlock is not enough. The padlock (https) in the address bar only shows that the connection is encrypted, not that the site can be trusted. Most fake sites use https too.
• Be careful if more information than necessary is requested. Being asked for your card number, expiry date, security code and an SMS verification code together for a parcel delivery is a big warning sign.
• If in doubt, close the site and open the organisation's official app, or type its address yourself.

The golden rule: don't tap, go there yourself

For any message claiming to come from an organisation, the safest method is: do not use the link in the message. Instead:

• Open your bank's official app.
• Enter the tracking number yourself on the delivery company's official website.
• Type the address of your tax authority's website yourself.
• If in doubt, call the organisation on an official number you know.

If there really is a problem, you will see it in the organisation's official channel too.

What to do if you tapped a link

Don't panic; act step by step:

If you only tapped and did not enter anything

• Close the page.
• If an unknown app or file (especially an .apk on Android) was downloaded to your phone, do not open it; delete it.
• Run a security scan on your phone.

If you entered card details

• Call your bank immediately and have the card blocked.
• Watch your card statement and dispute any transactions you do not recognise.

If you entered a password

• Change that account's password immediately.
• Also change it on other accounts where you used the same password.
• Turn on two-step verification.

If you shared a verification code or installed an app

• Call your bank and explain what happened.
• Remove the app installed on your phone. If a remote access app was installed, disconnect the phone from the internet and talk to your bank.
• If necessary, consider resetting the phone to factory settings.

In every case

• Report it: In the UK and the US you can forward scam texts free of charge to 7726. In the US, report fraud to the FTC at reportfraud.ftc.gov; elsewhere, use your national fraud reporting service. If you lost money, report it to the police.
• Keep the evidence: Save a screenshot of the message, the sender's number and the site's address.

For children and teenagers

Children are targets of these traps too: free in-game currency, free subscriptions, fake giveaways. Teach children: "Any message that promises something free and asks for your details or password is a trap. Show me before you tap." You will find more on this in our article on online gaming safety.

How Koriva helps

Koriva's link checking and web filter block known phishing sites; if the family wishes, they can also block adult and gambling sites. This protection works on Android and iPhone. The web filter only filters addresses; it does not read or store the content of the pages visited. On Android, suspicious links in messages sent to the child are also reported to the family. Still, no list can know every new fake site instantly, so the "don't tap, go there yourself" rule always applies.

Conclusion

SMS and WhatsApp scams use constantly changing scenarios but always the same basic tactics: urgency, fear or the promise of a gain, and a link. Going to the organisation's official channel yourself instead of tapping the link, never sharing verification codes and turning on two-step verification in WhatsApp make almost all of these traps ineffective.

For phone scams, see also our article on fake police phone scams.