What Are SMS Scam Messages?
Scam messages that arrive as text messages on your phone are known as smishing. The word is a blend of SMS and phishing. What lands in your inbox is a message dressed up as a service that really exists: a failed-delivery notice from a courier, an account warning from PayPay or Amazon, an unpaid-bill notice from an electricity company.
Tap the link inside the message and you are taken to a counterfeit site that looks exactly like the real thing, where you are asked to type in your ID, your password or your credit card number. Whatever you enter goes straight to the scam group, who then use it fraudulently.
Smishing has spread as an everyday scam that abuses SMS, and younger smartphone users are no exception. The people most likely to let their guard down are the ones who assume they could never be fooled, so age is no protection. As we explain in our piece on phone scams that target students, plenty of people in their teens and twenties fall victim too. Knowing how to spot an SMS scam is the single strongest weapon you have against it.
This article is here to get you to the point where you can judge an incoming SMS with your own eyes. If you have a message in front of you right now and want an automated check, you can paste the text into our SMS Scam Checker and get a verdict. Think of the checker as the tool that gives you an answer from a paste, and this article as the explanation of why that answer is what it is - which means the most reliable approach of all is to take the checker's verdict and confirm it against the checkpoints below.
How to Spot an SMS Scam - Five Checkpoints
Work through the following five points in order. If even one of them applies, the odds are high that you are looking at a scam; if several apply, it is a scam almost beyond doubt.
Checkpoint 1: Look at the Sender's Number
When a legitimate company sends an SMS, the sender is usually shown as the company's name or as a short number of around five digits. Scam messages, by contrast, nearly always arrive from a mobile number beginning 070, 080 or 090, or from a number carrying the +81 prefix.
A "notice from PayPay" or an "Amazon account warning" that arrives from a mobile number is a scam with near certainty. Companies do not send SMS from an individual's mobile number. That said, a sender shown as a company name is not grounds for relaxing either, because scam groups use caller ID spoofing techniques to make a legitimate company name appear. Do not judge on the number alone - check it against the other points as well.
Checkpoint 2: Beware of "Right Now" and "By the End of Today"
"Your account will be suspended unless you act by the end of today", "Complete the procedure within 24 hours" - phrasing that rushes you with a deadline is a textbook scam technique. A legitimate company will hardly ever impose an urgent deadline by SMS.
Before you tap the link in a hurry, take a deep breath and let yourself calm down. If the message really were important, the same notice would also be waiting for you in the official app or on the official website. Scam groups treat haste as their weapon. An SMS containing words like "right now", "immediately", "urgent" or "final notice" gives you reason enough on its own to suspect a scam.
Checkpoint 3: Read the URL Closely
Check the URL of any link the message contains. What you will find is a string that differs from the genuine address in some small way.
- amazon.co.jp becomes amaz0n.co.jp (the o is a zero)
- paypay.ne.jp becomes paypay-support.xyz (a different domain)
- sagawa-exp.co.jp becomes sagawa-exp.com (a different ending)
- rakuten.co.jp becomes rakuten-login.info (an entirely separate domain)
A shortened URL - bit.ly, t.co and the like - also calls for caution. Legitimate companies almost never use shortened URLs in an SMS. Getting into the habit of long-pressing a URL to preview where it actually leads keeps you safe.
Checkpoint 4: Check for Unnatural Japanese
Scam messages are frequently written by groups based overseas, which leaves telltale oddities in the Japanese.
- Kanji used incorrectly, with simplified Chinese characters mixed in
- Honorific language that does not quite work - for instance "O-kyakusama wa ryokin o shiharai shite kudasai", a mangled way of saying "please pay the charge"
- Punctuation in the wrong places
- Full-width and half-width characters used inconsistently
- Turns of phrase that Japanese companies do not use, such as "O-kyakusama kakui" (Dear Customers) or "Shin-ai naru user" (Dear User)
Bear in mind, though, that some scam messages are written in natural Japanese with the help of generative AI, so Japanese that reads naturally is no guarantee of safety. Treat the language check as one input among several and reach your judgement by combining it with the other points.
Checkpoint 5: Confirm Directly in the Official App
The most dependable method of all is to leave the link in the SMS untouched and go to the official app or official website yourself to check.
- A PayPay notification - open the PayPay app and check there
- An Amazon warning - use the Amazon app, or go to amazon.co.jp in your browser
- A failed-delivery notice - check in the courier's own app or on its tracking site
- An electricity bill notice - check on the official site of the electricity company you have a contract with
- A bank notification - log in to the bank's official app or official website and check
Reach the official site under your own steam rather than through the link in the SMS, and there is no way for you to be steered onto a counterfeit site. Make a habit of arriving at official sites from a bookmark or a search engine.
Real Examples of Common SMS Scams
Here are examples of scam messages that have actually been reported. If something like this arrives, ignore it and leave the link alone.
- "O-nimotsu no o-todoke ni agarimashita ga, fuzai no tame mochikaerimashita. Go-kakunin kudasai. http://..." - We attempted to deliver your parcel but took it back as you were out. Please confirm
- "[Important] There has been unauthorised access to your PayPay account. Please confirm at once"
- "There is a problem with the payment method for your Amazon Prime membership fee. Please update it within 24 hours"
- "[National Tax Agency] You have unpaid tax. If payment cannot be confirmed we will take legal action"
- "We have been unable to confirm payment of your usage charges. Please check by the end of today"
Every one of these is a scam. The National Tax Agency does not chase tax payments by SMS, and Amazon does not notify you of an account suspension by SMS either. Knowing the techniques behind scams that impersonate public authorities makes messages like these far less likely to throw you.
If You Have Already Tapped the Link
If all you did was tap the link, the chances are good that no harm has been done yet. Even if the counterfeit site appears, close the browser without entering anything.
If you did enter an ID or a password, take the following steps straight away.
- Change your password on the service in question
- Change it on any other service where you reuse the same password
- If you have not set up two-factor authentication, take this as your cue to switch it on
- If you entered credit card details, contact your card issuer and have the card suspended
- Tell a parent or guardian
If you have installed a malicious app, uninstall it at once and run a security scan on your phone. If you are still worried, talking to a shop run by your mobile carrier is a sound move.
Settings That Stop SMS Scams Before They Start
To cut down on scam messages arriving in the first place, put the following settings in place.
- Switch on your carrier's nuisance message filter - Docomo, au and SoftBank all offer this free of charge
- On iPhone: go to Settings, then Messages, and switch on Filter Unknown Senders
- On Android: switch on Spam protection in the Messages app
- When a suspicious SMS arrives, report it using your carrier's nuisance message reporting function
In Summary
SMS scam messages grow more cunning every year, but keep a grip on the five points - the sender's number, the language that rushes you, an address that does not look right, Japanese that feels off, and confirmation in the official app - and you can see through almost all of them. If you are in doubt: do not tap the link, check in the official app. Remember that much and you are safe. Pass these five checkpoints on to your friends and family as well. And if you do fall victim, use our guide to reporting phone scams and file a report without delay.