SMS and phone call scams aren’t just random spam, they are highly targeted social engineering attacks. In this complete guide, we’ll walk through the most common smishing and vishing scenarios, provide real-world examples, and give you ready-made responses to shut scammers down.


Smishing and phone scam awareness banner

Smishing Examples & Response Guide

Smishing (SMS phishing) is one of the most common and effective scams today.
Attackers exploit trust, urgency, and mobile habits to steal credentials, install malware, or harvest payment info.

This post breaks down real-world examples, explains the tactics used, and provides practical guidance on how to spot and respond to them.

What Is Smishing?

Smishing is short for SMS phishing — fraudulent messages designed to trick you into:

  • Clicking on malicious links
  • Entering credentials into fake websites
  • Downloading malicious mobile apps
  • Calling fake support numbers

Unlike email phishing, smishing exploits trust in mobile messaging — especially since many people read and act quickly on phones.

Common Smishing Scenarios

1. Parcel Delivery Notifications

“Your package is waiting. Reschedule delivery here: [bit.ly/track-delivery]”

Looks like Australia Post, UPS, DHL, or FedEx.
Link leads to a fake login or payment request to “release” the item.

2. Bank Account Alerts

“ANZ: Your account is temporarily locked. Tap to verify now.”

Uses urgency and fake branding.
Landing page often mirrors real bank login portals.

3. Mobile Carrier Messages

“Telstra: Your recent bill was unpaid. View details here: [short.link]”

If clicked, may lead to malware-laced APK or ask for payment.

4. Fake MFA/Verification Codes

“Your verification code is 294842. Don’t share this with anyone.”

You didn’t request this?
It may be a login attempt — someone is trying to reset your password or access your account.

How to Respond

  • Pause before tapping — especially shortened links
  • Don’t reply to unknown SMS senders, even to say “STOP”
  • Avoid downloading apps from links sent via SMS — use the app store
  • Contact the real service provider through official channels
  • Report smishing to your mobile provider or national scam reporting portal
    • Example (AU): forward to 7226 (SCAM)

Key Takeaway: Smishing Survival

  • Never trust links in unexpected SMS messages
  • Shortened URLs often lead to fake login pages
  • Banks and carriers won’t ask for info via SMS
  • MFA codes you didn’t request = suspicious
  • Always verify using official apps or websites
  • Report and delete — don’t interact

Phone scam defense banner

Common Phone Scams & What to Say

Vishing (voice phishing) involves phone calls designed to trick you into sharing information, sending money, or granting access to systems.

Unlike smishing, vishing is interactive — scammers use pressure, confusion, and social engineering to manipulate people in real time.

This post outlines the most common types of scam calls and provides safe response templates you can use.

Common Phone Scam Types

1. Tech Support Scams

“We’ve detected a virus on your computer. I’m calling from Microsoft/Apple. Please install this software so I can help.”

They walk the victim through installing remote access tools like TeamViewer or AnyDesk, then “fix” fake problems — often asking for payment at the end.

Say This Instead:

“Thanks for the call, but I don’t take unsolicited support calls. I’ll contact support through the official website if needed.”

2. Government or Law Enforcement Scams

“This is the ATO/IRS. There’s a warrant for your arrest unless you pay today.”

Relies on fear and urgency.
They often spoof official phone numbers and demand gift card or crypto payments.

Say This Instead:

“I’ll call back through the number listed on your official website.”

3. Bank Fraud Department

“There’s suspicious activity on your card. To verify your identity, please confirm your account number and PIN.”

Sometimes they’ll follow up with a fake verification SMS to make it seem real.

Say This Instead:

“I’m ending this call and contacting my bank through the number on my card.”

4. Voicemail Callback Traps

You get a missed call or voicemail saying:

“Your PayPal transaction for $899 was approved. Call now if this wasn’t you.”

Calling back connects you to a scammer posing as “fraud support,” often leading to remote access or payment scams.

Best Practice:

Don’t call back numbers from voicemails unless you’re expecting the call.
Check your actual PayPal/Bank app or log in directly.

Tips to Defuse the Scam

  • Never share personal or banking details over an unsolicited call
  • If you’re unsure, hang up — real organisations won’t pressure you to stay
  • Scammers often fake professionalism: case numbers, badge IDs, polite tone
  • Silence and hesitation are powerful — don’t be rushed
  • Always call back using official websites or cards

Key Takeaway: Vishing Defense

  • Tech support won’t cold-call you — especially not Microsoft
  • Government or police won’t ask for money over the phone
  • Banks don’t ask for PINs or send people to collect cards
  • Never trust phone numbers in voicemails or SMS
  • Always verify independently — use official channels
  • Practice polite refusal — it’s not rude, it’s smart
Awareness is the best defense. Whether it’s a suspicious text or a pushy caller, pausing to think, refusing to act under pressure, and verifying through official channels can stop these scams cold.