SMS fraud: how to recognise smishing and what to do if you shared your details
A single SMS is enough to trigger an organised fraud attempt. The National Cybersecurity Authority has already warned of new waves of smishing in 2026.
SMS fraud: a response guide from first contact to data breach
A message appears on the screen: "Your parcel could not be delivered". "Payment of fine is pending". "Your bank account has been temporarily blocked". Or more innocuously: "Hi, are you Maria?". Out of curiosity we reply — and immediately anxiety sets in. Can someone gain access to our mobile just because we answered? Ta Nea has published a detailed guide to the risks and protective steps.
I replied to a suspicious SMS — what have I lost?
In the overwhelming majority of common SMS fraud cases, a simple text message that we send in reply does not in itself give the fraudster access to photographs, files, codes or banking apps.
However, this does not mean that replying is entirely harmless. It reveals something simple but valuable to the fraudster: that the number is active and someone is reading the messages. The American Federal Trade Commission (FTC) specifically warns about so-called "wrong number texts" — messages that appear to have been sent by mistake to the wrong recipient. Even a brief reply confirms the existence of a real user behind the number, paving the way for new SMS, telephone calls or more targeted fraud attempts.
The safest rule: do not reply to unexpected messages from strangers.
What is smishing and where lies the real trap
The risk usually does not lie in the first SMS, but in the one that follows: the message that the fraudster uses to convince us to do something — to click a link, to call a number, to provide details. This is the fraud known as smishing, a combination of the words SMS and phishing.
Europol describes smishing as an organised attempt to obtain personal, financial or security credentials through written messages. Fraudsters typically impersonate banks, card companies, couriers, public authorities or other organisations and create a sense of urgency so that the victim acts without second thought.
The National Cybersecurity Authority warned in 2026 of SMS that appeared as notifications about alleged traffic violations, as well as messages that exploited state subsidies with the aim of stealing personal and banking data. The "urgent" element remains the fraudster's most powerful tool.
A simple reply — with no link, no details
If only a "yes", "no" or "who is this?" was sent, without clicking a link, downloading a file or providing personal or banking details, there is usually no reason to panic. There is no need to cancel a card or change all passwords.
However, four steps are necessary: we stop the conversation immediately, block the number, mark the message as spam and remain particularly wary of any subsequent messages or calls. We do not continue the conversation in order to "test" or "expose" the fraudster.
I clicked on a link — what do I do now?
A malicious link can lead to a fake website waiting for you to type in details, but it can also attempt to download malicious files or exploit device vulnerabilities.
The steps: close the page immediately, do not download anything, check whether an unknown app has been installed and make sure that the operating system and security apps are up to date. If an unknown app has been installed, the risk level increases and immediate inspection of the device is required.
I provided personal or banking details
There is no time to wait here. Contact your bank immediately, using exclusively its official telephone number or app — never contact details contained in the suspicious message. Request blocking of your card or account and immediately change any passwords that may have been compromised. If the same password is used on other services, it must be changed there as well.
Particular attention is required for one-time passwords (OTP): do not share them with anyone, even if the person you are speaking to presents themselves as a bank employee.
The appearance of a known sender is not a guarantee
The name of a bank or public authority in the sender field is not proof of authenticity. Fraudsters copy the logos, names and language of real organisations, and the details that appear as the sender should not be considered in themselves a guarantee of security.
If an SMS notifies you of a problem at a bank, courier or public authority, do not use the link and do not call the number provided by the message. Open the official app yourself or type in the known web address yourself.
Can an SMS infect my mobile without me doing anything?
Technically, yes. There are so-called zero-click attacks, in which specially crafted content can exploit software vulnerabilities without the user opening any link. However, this is not the usual mechanism behind mass messages like "your parcel was not delivered" or "you owe a fine". Zero-click attacks are generally much more complex and targeted — a further reason to install mobile security updates and app updates as soon as they become available.
The rule that applies to all suspicious messages
Every unexpected message that asks for money, codes, personal details or immediate action should be treated as suspicious until proved otherwise. There is no need to prove whether an SMS is fake — it is enough to verify the information from a different and independent channel.
Source: Ta Nea