A text about a package, a toll, or a bank problem is dangerous because of the link, not because of the story it tells.
First contact by text rose sharply through 2025 and 2026 and now rivals email. Almost half of victims who pay do it within an hour of the first message. There is no time for a second thought unless you build the habit in advance.
Smishing means a fraudulent text that wants you to tap a link or call a number. In April 2024 the FBI warned about texts that pretended to be unpaid toll bills. The link did not go to a toll authority. The same pattern shows up as a package delay, a tax refund, or a bank alert you were not expecting. The text looks finished because a model wrote it. Shortened links hide the domain. Do not tap. Open the real application.
Words in this chapter
Smishing. Phishing that arrives as a text message. The name combines SMS, the technical name for text messages, and phishing.
A pop-up that says the phone is infected, and that you must install a cleaner immediately, is usually the infection.
These alerts arrive as a browser pop-up, a text message, or an email. They copy the names of known security companies and use fear: act now or lose every photo and password. The link does not scan the phone. On Android it often downloads an APK, which is an application installer file from outside the store. That practice is called sideloading. The file can steal banking passwords, show endless advertisements, or lock the screen and demand payment. Locking files or the screen for payment is called ransomware.
iPhones are harder to sideload onto, but criminals still try with configuration profiles and enterprise certificates that ask you to trust a developer you have never heard of. Close the pop-up. Do not install the cleaner. If a tab will not close, force-quit the browser.
Security companies reported tens of millions of blocked Android malware attacks across 2024, and the count of new samples kept rising into 2025. The defense has not changed: official stores, no unexpected installers, and a current operating system.
Words in this chapter
Malware. Software written to harm the device or to steal from the person using it. Viruses, spyware, and ransomware are types of malware.
Sideloading. Installing a phone application from outside the Apple App Store or Google Play, usually by opening a file someone sent you.
Ransomware. Malware that locks your files or your screen and demands payment to unlock them. Paying does not guarantee the files come back.
A few seconds of recorded audio is now enough for software to imitate a familiar voice on a phone call.
Voice phishing is now a top way attackers get in. CrowdStrike measured extreme growth; Mandiant ranked vishing a leading initial vector in 2025 investigations. The FBI’s first AI category logged 22,364 complaints and $893 million in losses. 1
The call sounds like a child in trouble, a bank fraud desk, Apple Support, or a boss on a video call. Pressure is the product. Caller identification can be faked. That is caller ID spoofing: the name on the screen is not proof of who is calling. A caller who claims to be Microsoft support and asks for gift cards is using the same script. Real institutions will wait while you hang up and call back on a number from your statement or their official site.
Words in this chapter
Phishing. A message, page, or advertisement that pretends to be a company or a person you trust, so you will give up a password, a code, or money.
Vishing. Phishing that arrives as a phone call or voicemail. The name combines voice and phishing.
Caller ID spoofing. Faking the name or number that appears on a phone so a call looks like it comes from a bank, a utility, or someone you know.
A voice that sounds like your child or grandchild is no longer proof that the caller is that person.
The call or the voicemail says there was a crash, an arrest, or a hospital bill. The voice may be a recording, or it may be generated from clips posted online. That kind of imitation is a deepfake. A second person may come on the line and claim to be a lawyer or a police officer. They ask for gift cards, a wire, or cryptocurrency, and they tell you not to call anyone else.
Hang up. Call the family member back on the number already saved in your phone, not the number that just called you. Agree on a family code word now, before anyone needs it. A family code word is a private word or short phrase only your household knows. A real relative can say it. A stranger with a copied voice cannot.
Words in this chapter
Deepfake. Audio or video generated to imitate a real person’s voice or face. A familiar voice on the phone is no longer proof.
Family code word. A private word or short phrase your household agrees on in advance, so you can tell a real relative from a caller using a copied voice.
The phone rings once and stops. The missed call is the product, because the money is in the call back.
This is called a one-ring scam, and in some countries it is called wangiri. An automatic dialer rings just long enough to show a missed call, often from an international number. When you call back, you reach a premium-rate line. A premium-rate number charges far more than a normal call, sometimes many dollars per minute, and the criminal shares that fee. The call can look local until you notice the country code.
You do not need to call back to “clear” a missed call. If the number matters, the person will leave a voicemail or you will already have them saved. Check the phone bill once a month for international charges you do not recognize.
Words in this chapter
One-ring scam. A missed call, often international, placed so you will call back and pay a premium rate.
Premium-rate number. A phone number that bills far more than a normal call. The criminal receives a share of that bill.
Malware is the broad word for harmful software. Spyware is the kind that watches: messages, location, keystrokes, or the camera.
The usual way in is still an application or a link the person chose to open. Android is targeted far more often than iPhone because applications can be installed from outside the store. Once installed, the program may hide, send data to the criminal, and subscribe the phone to paid services. Families of malware such as Joker have infected millions of devices by hiding inside applications that looked ordinary.
Spyware is sometimes installed by someone who already has the unlocked phone, not only by a distant criminal. If a person you are afraid of has had the phone, the signs below matter, and so does help from a domestic-violence technology resource such as TechSafety.org, not only a fraud report.
Words in this chapter
Spyware. Malware that watches. It may record keystrokes, location, messages, or what is on the screen.
Malware. Software written to harm the device or to steal from the person using it. Viruses, spyware, and ransomware are types of malware.
A zero-click attack infects a device without a tap. These are rare, expensive, and aimed at specific people, not at everyone with a phone.
A zero-click exploit is a flaw so severe that a message or a call can install spyware before you open anything. Tools in this class, such as commercial spyware sold to governments, have been used against journalists, activists, and political staff. Apple, Google, and WhatsApp publish emergency updates when these flaws are found. In 2025 several of those updates arrived within days of the flaw being used.
For most people the practical defense is boring: install system updates the day they appear, and do not assume a strange glitch is spyware. For someone who has a reason to believe they are individually targeted, the next step is a current backup, a factory reset, and a specialist, not a random “cleaner” application from an advertisement.
Words in this chapter
Zero-click exploit. An attack that infects a device without you tapping a link, by abusing a flaw in the system. Rare, and the fix is the manufacturer’s update.
Spyware. Malware that watches. It may record keystrokes, location, messages, or what is on the screen.
A stranger texts “sorry, wrong person,” stays kind, and weeks later has a private investment to show you. That sequence is the scam.
This is the phone-side entrance to what investigators call pig butchering, and it is also a romance scam when the talk turns romantic. Romance scam means a relationship, real or pretended, used to get money. The first message is often an apology. The next weeks are photos, check-ins, and sympathy. Then there is a trading application the stranger “uses,” with a balance that only rises. The application is not a registered exchange. Withdrawals fail until you send more.
Federal Trade Commission figures put romance-scam losses in the billions, and a large share now start in text messages or social-media messages rather than on dating sites. The person on the other end may be reading a script. Video calls can be staged or generated. A reverse image search on the photos is worth doing, and it is not proof if the pictures are original. 4
The full investment pattern is also in the cryptocurrency kit. The rule on the phone is earlier: unsolicited warmth that turns into money is finished. You do not have to be rude. You do have to stop.
Words in this chapter
Pig butchering. A long scam that starts as friendship or romance and ends as a fake investment. The name is ugly because the criminal spends weeks “fattening” the target before asking for the large payment.
Romance scam. A relationship used to extract money. It may never meet in person, and it often turns into an investment pitch.
The Internal Revenue Service does not text you for payment. Police do not collect gift cards. Microsoft does not call you about a virus on your computer.
Government impersonation losses hit about $798 million in 2025, nearly double recent years, helped by AI voices. One-ring scams use a missed international call so the callback bills a premium rate. Tech-support pop-ups still push people toward remote-access apps and gift cards — $2.1 billion in that category alone. 1
Payment method is the tell. Gift cards, crypto, wire to a new account, or a payment app to a stranger are how scams cash out. Agencies bill by mail.
A bank will never ask you to move your money to protect it.
This is called a safe-account scam. The caller, or the text, says they are the fraud department. They may know a recent purchase. They say criminals are inside the account and you must move the balance to a safe account they will read to you, or into cryptocurrency, or into cash you hand to a courier. They tell you not to tell the branch, because the branch is compromised.
That transfer is the theft. A real bank can freeze an account itself. It does not need you to wire the money to a new account, buy gold, or use a cryptocurrency ATM. Hang up and call the number on the back of your card.
Words in this chapter
Safe-account scam. A caller pretending to be your bank who tells you to move money to a new account, into cash, or into cryptocurrency to protect it. The move is the theft.
A job that pays you to tap buttons, and then asks you to deposit your own money, is not a job.
A task scam starts as an offer to like videos, rate products, or click through simple tasks. The first payouts are small and real. That is the bait. The app then says you must deposit your own money to unlock the next set of tasks or to withdraw a larger balance. The deposit is the scam. Further withdrawals fail until you send more.
A real employer pays you. It does not ask you to fund the work. Treat an unsolicited job in a text or a messaging app the same way you treat an unsolicited investment. Stop, and do not send a deposit.
Words in this chapter
Task scam. A fake job that pays you for tiny online tasks, then asks you to deposit your own money to unlock more work or a withdrawal.
One odd symptom is usually nothing. Several at once, after a strange link or a lost signal, deserve a serious look.
Watch for a battery that falls much faster than usual, data use you cannot account for, the phone running hot while you are not using it, pop-ups, new toolbars, or applications you do not remember installing. Also watch for text messages you did not send, calls in the log you did not make, and new sign-ins to email or social accounts.
A sudden “no service” message in a place that normally has coverage is a different signal. That can be a SIM swap, which means your phone number was moved to someone else’s card. Treat that as urgent and use another phone to call the carrier.
Many people miss early signs because each one has an innocent explanation. The combination is what matters, especially if it started after an unexpected text or download.
Words in this chapter
Spyware. Malware that watches. It may record keystrokes, location, messages, or what is on the screen.
SIM swap. A criminal convinces your mobile carrier to move your phone number onto their card, then receives your calls and text-message codes.
Daily prevention, written as a list you can finish
The phone settings live in Lock the device itself. This list is the rest of the habit: accounts, the bill, and one other person in the house.
Use an authenticator application or a passkey for two-factor authentication instead of text-message codes on email, banking, and cryptocurrency. Two-factor authentication means a second proof, beyond the password, before a sign-in is accepted. Put unique passwords in a password manager. A password manager is an application that creates and stores a different long password for every site. Do not store recovery phrases or photographs of identity documents in the camera roll.
Turn off Bluetooth and location when you are not using them. You can see whether your number is forwarding calls by dialing star-pound-two-one-pound on many phones. If forwarding is on and you did not set it, call the carrier. Review the phone bill and set a credit alert if identity documents have ever leaked. Teach this list to one other person in the household. A scam that fails with you often moves to them.
Words in this chapter
Two-factor authentication. A second proof at sign-in, after the password. A stronger second proof is an authenticator application, a passkey, or a hardware key. A text-message code is a weak second proof.
Password manager. An application that creates and stores a different long password for every account, so you only have to remember one master password.
The usual way into a phone is still a person who is persuaded to tap a link or install an application. The settings below close that door.
Install applications only from the Apple App Store or Google Play. In 2024 Google blocked 2.36 million policy-violating Android applications, and harmful software still gets through, including applications that read screenshots to steal wallet details. 5 A flashlight does not need your contacts, camera, or location. On an iPhone, review each application in Settings. On Android, open Settings, then Privacy, then Permission manager. Leave Google Play Protect on: in the Play Store, tap your picture and confirm it is enabled. Do not install from a text, do not jailbreak the phone, and do not trust an unknown configuration profile.
Turn on automatic updates for the system and for applications. Lock the phone with a passcode of at least six digits plus biometrics, which means your face or fingerprint, and turn on remote wipe so a lost phone can be erased from a browser. Add a second passcode inside banking and password-manager applications. Make an encrypted backup and confirm you know how to restore it.
Public charging ports can be more than power. Juice jacking means a USB port wired to install software or copy data while the phone charges. Use your own cable and a wall outlet, not a kiosk port.
Words in this chapter
Juice jacking. A public charging port that is altered to install malware or copy data while a phone charges.
Remote wipe. A setting that lets you erase a lost or stolen phone from another computer or from the manufacturer’s website.
Biometrics. Using your face or fingerprint to unlock a device. Useful, and still paired with a long passcode in case the biometric fails.
Malware. Software written to harm the device or to steal from the person using it. Viruses, spyware, and ransomware are types of malware.