← Back to Blog Mobile Security

Smishing: the fake delivery and prize texts that target teens by phone number, not email

Photo by Paul Hanaoka on Unsplash

Most kids don't check email. They don't have a work inbox with a spam filter quietly doing triage before anything reaches them, and they don't yet have the "this looks like phishing" instinct built from years of ignoring fake invoices and password resets. What they do have is a phone number — attached to them personally, sitting in the same messages app as texts from friends and family. A scam text arrives in that same trusted thread. That's not a kid-carelessness problem; it's what makes SMS a fundamentally different, and more mobile-specific, attack surface than email ever was.

This isn't just intuition. Verizon's 2026 Data Breach Investigations Report — which measured voice and SMS phishing simulations at scale for the first time — found that phone-centric phishing produced meaningfully higher click-through rates than email, describing a roughly 40% gap between the two. Attackers are leaning into text and calls specifically because people have gotten better at spotting a fake email, and a text doesn't come with the same years of built-up suspicion. (Verizon 2026 Data Breach Investigations Report)

The bait is almost always one of two shapes: a problem ("your package couldn't be delivered, confirm your address") or a reward ("you've won a gift card, claim it here"). Both create the same pressure — tap now, think later — and both work because a text message shows no address bar, no sender domain to squint at, nothing but a short line of text and a link. An adult skimming email has some chance of noticing a slightly-off sender address before clicking; a text gives up that signal entirely.

A kid's phone number gets attached to game accounts, streaming logins, and family phone plans well before they're managing any of it themselves, which means it's already circulating in places a scammer's number-generation software can reach. And the "you've won something" framing hits differently for a kid than a "your bank account" alert would for an adult — a free gift card or game currency prize is exactly exciting enough to skip the pause that would otherwise catch it.

• Don't tap links in unexpected texts, full stop — treat it the same as a stranger handing over a link, regardless of what company name is attached.
• A real delivery or prize doesn't need a text link to be claimed — check directly through the retailer's own app or a phone number you already know is real, not one in the message.
• Urgency and "you've won" framing are the actual red flags — more reliable than anything about how professional the text looks.
• Report and block the number — most carriers let you forward scam texts (in the US, to 7726/"SPAM"), which helps flag the number for other people too.

It happens to adults as well, so keep the response calm. A quick sequence:

1. Don't panic or punish. A child who fears trouble will hide the next one.
2. Don't enter or share anything further, and close the page.
3. If any details were entered, change those passwords immediately and contact the bank or service.
4. If money was involved in India, call the national cybercrime helpline 1930 promptly and report at cybercrime.gov.in. Speed matters.
5. Block and report the sender through your messaging app and mobile operator.

Content filtering blocks a smishing link's destination at the DNS level once it's tapped and the domain is already known to be malicious. It can't stop the text from arriving, and a lot of these scam links use domains that are too new to be flagged yet — there's no blocklist entry for a site that didn't exist last week. The "don't tap it" habit above is the part no device setting replaces.

Content filtering in Paxio runs in the background to catch the links that are already known-bad, while you build the habit that catches everything else.

See why families choose Paxio if content filtering is the layer you want against scam links.

Try Paxio free →