Key Takeaways
- Phishing uses email; smishing uses SMS — but both try to steal your credentials or money.
- Fake purchase alerts often use urgency, generic greetings, and mismatched sender addresses.
- Never click links in unexpected order or delivery alerts — go directly to the retailer's site instead.
- Smishing texts are harder to inspect because URLs are shortened and sender info is easily spoofed.
- Reporting scam messages to the FTC or forwarding texts to 7726 (SPAM) helps protect others.
Option A
Phishing
The email-based fake alert, dressed up to look official.
Best for: Understanding email scams that mimic order confirmations, shipping notices, or account alerts from retailers.
Option B
Smishing
The text-message version — shorter, more urgent, harder to inspect.
Best for: Recognizing fraudulent SMS messages that pressure you to act fast on a fake delivery or suspicious charge.
If you received a suspicious email about an order you didn't place
Phishing awareness
Email scams have more red flags you can inspect — hover over links, check the sender domain, and look for mismatched branding before taking any action.
If you got an unexpected text about a package or charge
Smishing awareness
SMS scams give you less to work with, so the safest default is to never tap the link and instead verify directly through the retailer's official app or website.
If you want to protect yourself before any alert arrives
Phishing awareness
Learning to recognize email scam patterns gives you the strongest foundational defense, since phishing remains the most common entry point for credential theft.
What Makes These Two Scams Different
Both phishing and smishing are forms of social engineering — a term explained in our plain-English scam glossary. The goal in each case is identical: trick you into clicking a malicious link or surrendering login credentials and payment data. The delivery method is what sets them apart.
Phishing arrives via email and typically impersonates a well-known retailer, shipping carrier, or payment platform. Because email clients render HTML, scammers can recreate official-looking logos, formatting, and call-to-action buttons. That visual polish is part of the con.
Smishing (SMS + phishing) lands in your text messages. Texts strip away most visual cues — there's no logo, no letterhead, just a sentence or two and a link. Scammers compensate with urgency: "Your package is held. Confirm address now" or "Unauthorized charge detected. Verify immediately."
| Criterion | Phishing (Email) | Smishing (Text) |
|---|---|---|
| Delivery channel | SMS / text message | |
| Visual disguise | Logos, HTML formatting, buttons | Plain text, minimal formatting |
| Link inspection | Hover to preview destination URL | Shortened URLs hide destination |
| Sender verification | Expand sender field to check domain | Caller ID easily spoofed |
| Common lure | Order confirmation, account alert | Package held, suspicious charge |
| Primary pressure tactic | Account suspension threat | Immediate action / fee demand |
| Reporting channel | spam@uce.gov / FTC | Forward to 7726 (SPAM) |
Understanding which channel you're dealing with matters because your defensive tools differ. With email, you have more to inspect. With a text, you have almost nothing but context and common sense.
Red Flags in Fake Purchase Alert Emails
Phishing emails impersonating retailers have grown more convincing, but several tells remain consistent:
- Sender domain mismatch: The display name may read "Amazon Customer Service" but the actual sending address ends in a random domain. Always expand the sender field.
- Generic greeting: Legitimate order confirmations use your name. "Dear Customer" or "Hello Valued Member" is a warning sign.
- Urgency framing: Phrases like "Your account will be suspended" or "Act within 24 hours" are pressure tactics designed to override careful thinking.
- Hover-over URL mismatch: Before clicking any link, hover over it. If the destination URL doesn't match the retailer's official domain — or uses a lookalike domain with a subtle misspelling — do not click.
- Unexpected attachment: Real order confirmations don't come with executable files or password-protected zips.
If an email prompts you to "confirm your order" for something you never bought, go directly to the retailer's website by typing the address yourself — don't use the email's link. Our pre-purchase safety checklist walks through similar verification habits worth building before and after any transaction.
One-Click Danger: Why Link Previews Matter
On desktop email clients, hovering over a link before clicking reveals the actual destination URL in the browser status bar. On mobile, you can often long-press a link to preview it. If the URL contains an unfamiliar domain, a misspelled retailer name, or an IP address instead of a domain name, treat it as fraudulent and delete the message. This single habit blocks a large share of phishing attempts.
Red Flags in Fake Purchase Alert Texts
Smishing texts are more constrained in length but no less dangerous. Watch for these patterns:
- Unknown or 10-digit number: Carriers and major retailers increasingly use short codes or verified sender IDs. A random 10-digit number claiming to be a shipping carrier deserves immediate suspicion.
- Shortened or scrambled URLs: Links like
bit.ly/xR93qoramzn-secure-verify.comhide their true destination. There's no safe way to preview these on most phones without a link-preview tool. - Request for personal confirmation: Legitimate delivery services do not ask you to re-enter your address, credit card, or login credentials via a text link.
- Pressure around a "fee" or "customs charge": A common smishing variant claims your package is held pending a small fee. Real carriers include such notices with formal documentation, not a spontaneous text.
327%
Increase in smishing attacks reported
The FTC has reported a sustained and dramatic rise in text-based fraud complaints over recent years, with package-delivery scams among the most frequently cited.
3 in 10
Adults who have clicked a scam text link
Survey data from cybersecurity researchers suggests roughly one-third of recipients have tapped a link in a suspicious text at least once.
The safest response to any unexpected delivery or charge text is to open your retailer's official app or type the retailer's address directly in your browser and check your order history there. Building safer online shopping habits — like using virtual card numbers — can also limit the damage if you ever do fall for one of these.
What to Do If You Suspect a Scam Alert
If you've already clicked a link in a suspicious message, take these steps promptly — but understand this is general guidance, not a guarantee of any specific outcome:
- Change the password for any account you may have entered credentials on, using a device you trust.
- If payment information was entered, contact your card issuer directly using the number on the back of the card to report potential fraud.
- Run a security scan on the device you used if you downloaded anything.
To report scams: forward suspicious texts to 7726 (spells SPAM on most keypads) — major U.S. carriers use this number to flag smishing. Report phishing emails to the FTC at reportfraud.ftc.gov or forward them to spam@uce.gov.
For a deeper look at how these schemes are constructed, our breakdown of online shopping scams explains why even cautious shoppers get caught. And if you want to compare phishing and smishing in a broader security context, this companion article covers credential theft tactics in more detail.