An older woman's hands holding a smartphone.

Text Message Scams Targeting Seniors: How Smishing Works

The Chase text wasn't from Chase. The USPS text wasn't from USPS. The 10-second check that catches nearly all of them.

By Tiina Team Updated September 25, 2026 10 min read
Listen · Tiina reads this
The short version, in Tiina's actual voice.
1:04
In one paragraph

Text-message scams ('smishing') are among the fastest-growing scam categories against older adults. The patterns are predictable: fake bank fraud alerts, fake package-delivery problems, fake Apple ID locks. Every one of them asks for a click or a code. The 10-second check that catches nearly all of them: don't tap the link. Open the actual app (Chase, USPS, Apple) and check there. If the alert is real, it'll show in the app. If it's not, the link was going to steal credentials. We've also seen the rise of AI-voice phone scams using texted callback numbers. Same principle: don't call the number in the text.

The text said it was Chase Bank. It wasn't Chase Bank. It used Margaret's name. It said there were fraudulent charges in Texas (three hundred and forty dollars at a gas station outside Houston) and that her account had been frozen for her protection. Under that, a link: tap to verify your PIN and unlock the account.

It looked so official. A case number, tidy bank language, even a "reply STOP to opt out" line at the bottom. Margaret didn't tap. She opened Tiina on her iPhone and read the text out loud, word for word.

Tiina answered calmly: "Banks never text you a link to verify a PIN. This is a smishing scam. Don't tap it. If you want to be sure, call the number on the back of your card."

She forwarded the text to 7726, the way Tiina walked her through it. Deleted it. Called Chase from the back of her card. No charges. No frozen account. The link died on her screen.

The three smishing patterns running right now

Recognize these
  • Bank fraud alert. "We detected a $X charge in [distant city]. Reply YES to confirm or NO to cancel. To speak with fraud team, call [number]." The number is the scammer. Don't reply, don't tap any link, and don't call the number.
  • USPS / FedEx / UPS undeliverable package. "Your package can't be delivered. Update your address: [link]." The link goes to a fake site that asks for your card number or a "redelivery fee."
  • Apple ID lock / Microsoft account compromise. "Your Apple ID has been locked. Sign in to verify: [link]." Apple never texts you links to sign in. Microsoft doesn't either.

Newer patterns, like fake Medicare card, unpaid toll and IRS refund texts, are covered further down.

The 10-second check

Three steps. Memorize this:

  1. Don't tap the link. Ever. If action is really needed, it will be waiting in the organization's own app or website. You never need the link in the text.
  2. Open the actual app. Open Chase. Open USPS. For an Apple alert, open Settings and tap your name at the top. If the alert is real, you'll see it there.
  3. If unsure, call the official number on the back of your card (or the company's official website, typed by hand, not searched). Not the number in the text.

Run this check every time. The 10-second cost prevents the 6-month consequence.

An older woman in her kitchen holding up her phone with both hands.
The text comes in. She doesn't tap. She opens Tiina and reads it out loud.

What to do with a suspected smishing text

Clicking the link in a smishing text usually does one of three things: takes you to a fake login page that steals your username and password the moment you type them, downloads malware in the background (more common on Android than iPhone), or opens a fake form that captures your Social Security number, bank info, or credit card. On iPhone, just opening the link rarely installs anything. But if you typed any information on the page that loaded, assume it is compromised. Change the password for that account immediately, turn on two-factor authentication, and watch the account for the next 30 days. Do not click "unsubscribe" either. That confirms your number is live.
Common smishing texts in 2026: fake USPS or FedEx delivery notices ("Your package is delayed, click here to update your address"); fake bank fraud alerts ("Did you authorize a $487 charge? Reply YES or NO"); fake toll violations ("You have an unpaid E-ZPass toll, pay now to avoid suspension"); fake IRS or Social Security threats; fake Amazon order confirmations for things you did not buy; and fake "hi mom" texts from a new number claiming the kid's phone broke. The toll scam took off in 2024. Within about six weeks of the first reports, the FBI's IC3 had logged more than 2,000 complaints, and the texts kept moving from state to state. The tell is always urgency plus a link plus a request to act now.
Forward the spam text to 7726 (which spells SPAM). This reports it to your carrier and helps them block the sender for everyone. Then delete and block the number. On a current iPhone, open Messages, tap the filter button at the top of the conversation list, tap Manage Filtering, and turn on Screen Unknown Senders. Texts from numbers you don't know then go to a separate folder. Add the carrier's free spam protection (Verizon Call Filter, AT&T ActiveArmor, T-Mobile Scam Shield). All three filter texts too. Do not reply, do not click, do not unsubscribe. For a parent who clicks everything, add a third-party scam-blocker app with text filtering.
Replying to a smishing text, even just "STOP" or "NO", confirms to the scammer that your phone number is active and that a real person reads the messages. Your number then gets flagged as high-value and sold to other scam operations, so you will get more spam, not less. The reply itself does not give them your bank account or password, but it escalates the volume of attacks. If you replied and did not click a link or share information, you are mostly fine. Just expect more smishing for the next few months. If you did share anything, treat it as compromised and start changing passwords.
Tiina helps them stop before they act.

A scammer counts on no one being there to ask. Tiina is. She's on your parent's iPhone, ready to talk through any "urgent" call, calmly, before they do anything they can't undo.

7 days free · Cancel anytime
Try Tiina free →

The newer smishing patterns running in 2026

Smishing evolves fast. Federal agencies and carriers play whack-a-mole. The ones we see most often right now:

Active patterns this quarter
  • Fake Medicare card replacement. "Your new Medicare card is pending. Verify your number to receive it: [link]." Medicare doesn't text. Real card replacements come by mail. See our pillar guide for the longer treatment of Medicare scams.
  • Fake state-DMV unpaid toll. "You owe $4.75 in unpaid tolls. Pay now to avoid fees: [link]." Spreading rapidly through Texas, California, Florida. Don't pay a toll from a link in a text. Check your account on the toll agency's real website, typed by hand.
  • Fake IRS refund. "Your IRS refund of $1,402 is ready. Verify your details to receive it: [link]." The IRS does NOT text refund notifications. Check a refund with the "Where's My Refund?" tool on IRS.gov, typed by hand.
  • Fake utility shutoff threat. "Your power will be shut off in 30 minutes for non-payment. Pay immediately: [link]." Real utilities send written notice before a shutoff. Anyone threatening same-day shutoff by text is a scammer.
  • Fake bank login alert with callback number. "Suspicious sign-in detected. If this wasn't you, call [number]." The callback number connects to a scammer who walks your parent through "verification" that drains their account. The text-then-call pattern is harder to spot than text-with-link.

When in doubt: forward to 7726 (SPAM) from the text thread. Standard cross-carrier reporting number. The carriers track these and block patterns at scale.

If your parent already tapped the link: the 30-minute checklist

Tapping a link alone usually doesn't compromise the phone. Modern browsers sandbox most attacks. The risk is what your parent did NEXT. If they tapped and:

  1. Only viewed the page (no taps, no info entered): clear browser history and cache, update iOS to the latest version, watch the affected account for a week. Most likely safe.
  2. Entered a password: change that password EVERYWHERE that password is used. Then enable two-factor auth on the real account. Then call the bank/Apple/Amazon to confirm no suspicious activity.
  3. Entered a credit/debit card: call the card's fraud line on the back of the card. Replace the card. Watch for charges over 60 days.
  4. Entered SSN or Medicare number: freeze credit at all three bureaus (Equifax, Experian, TransUnion). It's free at all three. File at identitytheft.gov. See our recovery guide for the full timeline.
  5. Sent money via gift cards, wire, or Zelle: call your bank, or the company that issued the gift card, within the hour. Recovery is partial-at-best but speed matters. File an IC3 complaint at ic3.gov same-day.

Speed matters more than perfection. Better to overreact in the first hour than to optimize the response in week three.

An iPhone lying face down on a table beside reading glasses and a mug.
The right move, ninety-nine times out of a hundred. Set it down. Forward it to 7726, then delete it.

What this sounds like with Tiina in the room

11:35 AM. Your mom's phone buzzed five minutes ago. A text said her Chase account was locked, with a link to verify her PIN. She doesn't have a Chase account. But she's seen the news about scammers and isn't sure. She takes a screenshot of the text, opens Tiina, and asks, "Is this a scam?" Tiina answers. Yes. Banks never text you links to verify a PIN. Walks her through what to do: don't tap, forward to 7726, delete. Doesn't make her feel paranoid for asking. Your mom forwards it. Deletes it. Goes back to her crossword.

11:47•••
M
Mom
Tuesday 11:42 AM
Got a text saying my Chase account was locked. I don't have a Chase account.
Showed it to Tiina. She said it was a scam. Banks never text you links like that.
Forwarded it to 7726 like she said, then deleted it. Felt smart.
A text from a mom to her daughter. The Tuesday she stopped forwarding scam texts asking what they meant.

Mom reads the text to Tiina before she taps the link.

"USPS package held." "Chase account locked." "Your grandson needs bail." She reads it out loud, Tiina answers, and the link dies on her screen instead of in her checking account.

7 days free · Then $9.99/month · Cancel anytime
Not ready? Read the full 7-scam guide for seniors.
Listen · Real Tiina voice
This is what Tiina actually sounds like.
A scripted scenario: an 84-year-old widow reads Tiina a USPS text about a package fee.
A Tiina conversation
Margaret: "Tiina, USPS just texted me about a package fee."
0:27

Methodology & editorial policy

Reviewed and updated September 25, 2026 by the Tiina Editorial Team. Patterns sourced from FTC, FBI IC3 and AARP scam alerts and CTIA's spam-text guidance, listed below. Re-checked monthly as new templates emerge.

About composite scenarios. Margaret is a composite character, and the scenes and sample conversations in this article are illustrative. The three current patterns and the 10-second check are sourced from active federal advisories.

About Tiina. Tiina is a voice-first AI companion for older adults: an app for iPhone and iPad that your parent opens to talk through a moment that doesn't feel right.

Sharing. Quote freely with a link back to this page. For full reprints, email hello@tiina.ai.

Sources. 6 references: FTC, FBI IC3, FCC, CTIA, AARP Fraud Watch, Apple Support.View all
  1. FTC Consumer Advice. How to Recognize and Report Spam Text Messages. consumer.ftc.gov
  2. FBI Internet Crime Complaint Center. Smishing Scam Regarding Debt for Road Toll Services (PSA240412, Apr 2024; toll-text complaint volume). ic3.gov
  3. FCC. Stop Unwanted Robocalls and Texts. fcc.gov
  4. CTIA. Protecting Yourself from Spam Text Messages. ctia.org
  5. Apple Support. Screen and filter text messages on iPhone. support.apple.com
  6. AARP Fraud Watch. Criminals Are Stealing More Money Through Text Scams Than Ever Before (June 2025). aarp.org
Related

Read next

The full guide An older woman holding a landline phone to her ear in her kitchen, looking concerned.
7 Phone Scams Targeting Seniors + the Sentence That Stops Each
A guide for the adult children of a generation that still answers the phone.
18 min read
Recovery An adult daughter at her kitchen table at night, on the phone with her mother's bank, a notepad, pen and laptop in front of her.
What to Do if Your Parent Was Just Scammed
A timeline. The first 60 minutes matter most. The first 24 hours come next. Then the first week.
12 min read
Apps An iPhone lying face down on a wooden table beside reading glasses and a steaming cup of coffee.
The Best Scam Blocker Apps for Seniors, Compared
Five apps compared. Honest math. We'll tell you when Tiina isn't the answer.
11 min read
Scams An older man sitting up in bed at 2 a.m. holding his phone, lit by bedside lamps, his wife asleep behind him.
The Grandparent Scam: AI Voice Clones and the Three Calls
The three calls, the family code word that stops them, and what to do when your dad hears his grandson's voice and heads for the bank before he calls anyone.
13 min read