AI Text Scams: How to Spot Smishing Before You Tap
Scammers now use AI to write flawless texts and clone real websites at scale. Here is how to spot a fake before you tap, and what to do if you already did.
Table of contents
For years, the easiest way to spot a scam text was the bad grammar. That tell is gone. Artificial intelligence now writes clean, urgent, believable messages and builds convincing fake websites in seconds, which means the old advice of "just look for typos" no longer protects you. This is a plain-English guide to spotting smishing (scam texts) in 2026, with a checklist to run before you tap any link and clear steps for what to do if you already entered your details.
What changed: AI made scams cheaper and better
In June 2026, Google announced legal and technical action against an organized cybercrime network it calls Outsider Enterprise. According to Google, the group is based in China, coordinates through messaging apps, and sells ready-made phishing kits so that even low-skill criminals can launch fake text campaigns impersonating trusted brands. Google says the operation is linked to roughly 9,000 counterfeit websites and more than one million fraudulent URLs. In a single two-week stretch in May 2026, Android users flagged about 55,000 spam texts tied to the group, out of an estimated 2.5 million deceptive messages sent.
The takeaway for ordinary people is simple: scams are now produced at industrial scale. AI no longer just boosts office productivity; it helps criminals write better texts, clone real sites, and target millions of people at once.
The money involved is not small. The FBI's Internet Crime Complaint Center received 859,532 complaints in 2024 and reported losses topping 16 billion dollars, a 33 percent jump from the year before. Investment fraud, much of it involving cryptocurrency, accounted for over 6.5 billion dollars, and the FBI notes that people over 60 lost the most. Many of these scams begin with a single text or email.
What smishing looks like now
The most common AI-assisted scam texts fall into a few familiar buckets. Knowing the templates helps you recognize them on sight.
| Scam type | Typical hook | Why it works |
|---|---|---|
| Fake delivery alert | "Your package is held. Confirm your address and pay a small fee." | Almost everyone is expecting a parcel from somewhere. |
| Bank or card warning | "Suspicious login detected. Verify your account now or it will be locked." | Fear of losing money makes people act fast. |
| Toll or fine notice | "You have an unpaid road toll. Pay within 24 hours to avoid penalties." | Sounds official and time-limited. |
| Account or prize message | "Your subscription failed" or "You've won, claim here." | Curiosity or worry about a real account you have. |
| "Wrong number" chat | A friendly stranger texts, then slowly builds trust toward a crypto "tip." | Patience and personal connection lower your guard. |
The links in these messages lead to phishing pages: pixel-perfect copies of a bank, courier, or login screen, built to capture whatever you type. With AI, those fake pages now look identical to the real thing.
The red flags that still work
Grammar is no longer reliable, but the underlying pressure tactics are. Watch for these:
- Urgency and threats. "Act in 24 hours," "your account will be closed," "final notice." Real institutions rarely demand instant action by text.
- A link to log in or pay. Legitimate banks and couriers ask you to use their official app or to type their address yourself, not to tap a link in an SMS.
- An odd or shortened web address. Look at the domain carefully. Scammers use lookalikes such as a real brand name buried inside a longer, unrelated address.
- A request for codes or passwords. No real company will text you and ask for your one-time code, PIN, or full password.
- An unexpected channel. A toll authority or bank you have never given your mobile number to suddenly texting you is a warning sign.
Your before-you-tap checklist
When a message lands, pause and run through this list before touching anything:
- Do not tap the link. Treat every link in an unexpected text or email as suspicious by default.
- Check who really sent it. Look at the sender, but remember sender names and numbers can be faked. The content matters more than the number.
- Ask if you were expecting this. No pending package, no recent purchase, no account with that company? Then it is almost certainly fake.
- Go direct instead. Open the company's official app, or type the address into your browser yourself. Never navigate from the message.
- Verify by a separate channel. Call the number printed on your bank card or official statement, not any number in the text.
- Report and delete. On Android and iPhone you can report junk or spam, which helps carriers block the campaign. Google says built-in defenses already block over 10 billion malicious messages a month, and your reports feed those systems.
If you are still unsure, do nothing. A genuine notice will still be reachable through the official app or website ten minutes later.
If you work or shop on your phone all day
If you handle banking, shopping, or work email mostly on your phone, add two habits. First, turn on multi-factor authentication or, better, passkeys on your important accounts, so a stolen password alone is not enough. Second, slow down: most successful smishing relies on you reacting in the first few seconds. Build a personal rule that you never log in or pay from a link in a message.
What to do AFTER you've entered details
Mistakes happen, and fast action limits the damage. If you tapped a link and typed anything into a fake page:
- Change that password immediately from a device you trust, and change it anywhere you reused it.
- Contact your bank or card issuer if you entered card or banking details. Ask them to watch for or block fraudulent charges.
- Turn on multi-factor authentication on the affected account if it was not already on.
- Watch your statements closely for a few weeks and dispute anything you do not recognize.
- Report it to your bank, your mobile carrier, and your national fraud reporting service. In the US, that is the FBI's Internet Crime Complaint Center and the FTC.
- Scan your device with a reputable security app if you also downloaded anything, since some scams push apps that quietly steal data.
Where a VPN fits, and where it does not
A VPN is a useful privacy layer, especially on public or untrusted networks. It encrypts your connection so the local network and your internet provider cannot easily see the sites you visit, which is genuinely valuable when you are on hotel, airport, or cafe Wi-Fi.
Be honest with yourself about its limits, though. A VPN does not stop phishing or smishing. If you tap a scam link and type your password into a fake page, a VPN will faithfully encrypt that mistake on its way to the criminal. It is not antivirus, it is not a password manager, and it does not replace multi-factor authentication, software updates, or backups. Against text scams, your habits and your second factor protect you, not your VPN.
Want to sort out which tool actually protects you against what?
Bottom line
- AI has erased the old typo-spotting trick, so judge texts by behavior: unexpected message, urgent threat, and a link to log in or pay are the real red flags.
- Never act from a link in a message. Go to the official app or type the address yourself, and turn on multi-factor authentication or passkeys.
- If you already entered details, move fast: change passwords, call your bank, and report it. A VPN protects your connection, but only your habits stop a scam.
Which do you need first: VPN, antivirus or a password manager?
