Can You Spot the Smish? Package Text Quiz

A smish is a phishing attempt that arrives by text message. Instead of asking you to spot one in your own inbox, here's a safe way to practice: a made-up delivery text with four planted red flags. Read it, count what you catch, then scroll down to check yourself.

VexParcel, the link, and the message below are fictional — invented for this quiz. There is no real courier called VexParcel, and the link doesn't lead anywhere real. The red flags hiding in it are the real thing. They show up in actual smishing texts every day.

Smishing is phishing's text-message cousin — for the email version, see the briefing Spot the phish before you touch the bait.

The Smishing Text: Read It Before You Scroll

The message arrives like this, from a number you don't recognize:

Pause here. How many red flags can you find? There are four. Write down your guesses before you scroll.

The 4 Smishing Red Flags, Revealed

Flag 1: An Unexpected Text From an Unknown Number

The whole thing starts with the sender. (555) 014-2287 — unrecognized, unannounced, and the message arrives out of the blue. No order you remember, no tracking you were waiting for, just a courier you don't know telling you a package is being held.

The FTC and the FCC start in the same place: a text you were not expecting, from a number you do not know, that asks for personal or financial information is a stop sign, not a starting point — do not tap its links. The FCC puts the rule plainly: "Do not respond to texts from unknown numbers, or any others that appear suspicious."

That's the first gate. An unexpected text from a stranger asking you to act — tap a link, pay a fee — is reason enough to stop.

Flag 2: A Shortened Link That Hides Its Real Destination

The message hands you a link to "track your package": vx-track.click/9x4q. It's short, which means it tells you nothing about where it actually leads. You can't read the real destination in the text, and that's the point of the shortener.

Shortened links are a standard hiding trick — in CISA's words, a shortening service can "hide the true destination of the link." What waits at the other end, the FTC and the FCC both warn, is often a fake site built to look like the real one. Log in there, and the username and password you type go straight to the scammer.

A real delivery company has no reason to hide its tracking page behind a short link. When a text asks you to tap a link you can't inspect, treat it as a dead end.

Want more practice reading suspicious links? Try the on-page quiz Would you catch the phish?

Flag 3: A Small "Redelivery Fee" Demanded by Text

The amount is small on purpose. A dollar fifty feels too trivial to question — of course you'd pay that to get your package moving. But the demand itself is the flag, not the amount.

The rule from both the FTC and the FCC is simple: legitimate companies do not ask for account information by text, and you should never send sensitive personal or financial information that way. A real courier does not collect payments through a random text message. The fee exists to get you to tap the link and hand over your payment details — that's the whole play.

Flag 4: A Manufactured Deadline That Creates Urgency

The message ends with a deadline: act today or lose the package. That deadline is manufactured. Its only job is to push you to tap, pay, and log in before you think.

CISA describes urgency as a core social-engineering tactic: manufacture a sense of importance so the target acts before stopping to examine what they were actually sent. Urgency is pressure, not proof. Anything real can wait for you to verify it on your own terms — by going to the company's official site yourself or checking an order you actually placed.

What to Do When You Get a Smishing Text

Don't reply, don't tap the link, and don't pay anything. Then do two things:

1. Forward the text to 7726 (SPAM).That is the number the FTC names directly: "Copy the message and forward it to 7726 (SPAM)." Forwarding helps your wireless provider spot and block similar messages, and the FCC gives the same instruction for reporting scam text attempts.
2. Report it to the FTC at ReportFraud.ftc.gov.That's the FTC's own instruction, and the report helps investigators track the pattern.

If you're ever unsure whether a delivery text is real, don't use the link in the message. Go to the courier's official website yourself, or check the order confirmation you got when you bought the item. If there's no order you recognize, there is no package — and no fee owed.

Scam links are risky on any network — see the briefing Public Wi-Fi: use it without trusting it.

Sources: FTC: How to Recognize and Report Spam Text Messages ↗ · FCC robotexts consumer blog ↗ · CISA: Avoiding Social Engineering and Phishing Attacks ↗