Paste an SMS or email — we estimate smishing likelihood from any link's risk plus urgency, bait and action-demand phrasing, no model. A rough guide.
Free with no sign-up, and the check runs inside your browser, so what you enter never leaves your device. The result is a signal to help you decide, not proof for money or legal decisions.
Paste a smishing (SMS phishing) message impersonating a courier, government subsidy, obituary or fine, and it analyses both the risk of any embedded link and the phrases common to scams.
Typical lines: "[International] Parcel address mismatch, please re-enter", "[Gov24] Subsidy application closing soon", "Notice of passing". What they share: (1) they manufacture urgency, (2) they push a link, and (3) the link leads to a fake login or app install.
Recently, messenger phishing has grown — impersonating your child or an acquaintance ("my phone broke, contact me on this number") to demand gift cards or bank transfers. If the sender number is unfamiliar and the conversation feels off, always call the original number to confirm.
It finds any URL in the text and scores its link risk, together with the density of phrases common to scams (urgent, prize, unpaid, identity verification). The more dangerous the link or the more scam phrasing, the higher the score.
A low score is no reason to relax. A polished message, or pure impersonation with no link (asking for a bank transfer), may not be caught by text signals alone.
A lot gets sorted before you read a single word. Banks, carriers and delivery firms send from registered sender numbers or well-known corporate lines. A "customer service" notice arriving from an ordinary mobile number, or a domestic institution appearing as an international send, does not add up.
Public bodies and financial institutions in some markets attach a verified-sender mark to their messages: a logo and confirmation badge at the head of the text. Its presence means the sender was verified; its absence does not automatically mean fraud, but impersonation never carries it. Line the message up against an older one from the same institution and the difference shows.
When the same wording arrives repeatedly from rotating numbers, that is bulk sending. Do not tap the unsubscribe link inside it. That tap signals a live number and usually increases the volume. Report it as spam through your carrier instead.
Smishing often does not end at the link; it ends at an app install. A malicious app typically does three things. It intercepts calls in both directions, so dialling your bank connects you to the fraudster and the standard "call and check" defence collapses. It reads incoming messages to harvest verification codes. And it collects contacts to spread the same message to people who know you.
Android asks per-app for permission to install from unknown sources. If the browser or messenger that opened from a text asks for that, stop there. On iPhone the equivalent is a push to install a configuration profile or an enterprise-signed app. Check Settings for unfamiliar profiles and remove them.
If it is already installed, follow the order. Put the device in airplane mode to cut further transmission, delete the app, then contact your carrier to block premium charges and check for accounts opened in your name. Make that call from someone else's phone: calls from the affected device can be intercepted.
It opened with "Mum, my screen is cracked and the phone is at the repair shop — reach me on this number", and moved on to a request for a photo of an ID and a transfer, because verification supposedly would not go through. No link ever appeared. Urgency, identity-verification and money markers light up, but with no link component the total sits mid-range. The decisive step here is not the score but a single action. Call the number you already had saved. However natural the conversation feels, that one call ends it.
"[International] Delivery held — address mismatch" followed by a shortened link. Urgency, an address request and an opaque link all sit in one short message. Bait phrasing and link risk rise together for a high score. The decisive fact is that real couriers resolve delivery problems in their app or on a published number, never through a link in an unsolicited text.
A billing notice was pasted in. The link pointed at the carrier’s own domain, nothing asked for personal data or payment, and no deadline pressure appeared. The score stays low. The heaviest smishing signals are the link domain and the demand for immediate action; with neither present, stiff official phrasing alone is not treated as risk.
Genuine couriers and public agencies also send shortened URLs and "by today" phrasing. In those messages the structure matches a scam, so the score comes out high. Sender numbers are trivially spoofed, so "the number looks right" proves nothing either. Rather than trusting the score in either direction, open the organisation’s app or call a number you already had saved.
If you installed an app, delete it immediately, run a mobile antivirus scan and block carrier micro-payments. Change account passwords and check for unusual charges.
Not all, but domestic agencies and couriers almost never ask for personal data via international senders. Treat it as a strong warning signal.
No. Carrier and regulator reports pass the received content along; the sender is not notified. Tapping the unsubscribe link inside the message is the opposite. That sends a signal straight back.
Yes. It is scored on wording alone, without a link component, which tends to produce a lower total. If the message asks for an account number, gift card codes or a photo of your ID, treat it as fraud regardless of the score.