To report smishing, forward the scam text to 7726 on your phone, use your messaging app’s built-in spam report, and file complaints with the FTC at ReportFraud.ftc.gov, the FCC at consumercomplaints.fcc.gov, and — if you lost money or personal information — the FBI’s Internet Crime Complaint Center at ic3.gov. If the text impersonated a specific company or agency, tell that organization too. Filing through several channels feeds the databases carriers and investigators actually use to block numbers, spot patterns, and, occasionally, recover stolen funds.
Grab a Screenshot Before You Do Anything Else
Take a screenshot of the message first. One image captures the sender’s number, the full text, any link, and the timestamp, and you never have to tap the link to get it. That screenshot becomes your reference for every report that follows.
Note two more details while you have the message open. Is the sender a regular ten-digit phone number or a five-to-six-digit short code? Your messaging app’s “message details” or “sender info” screen will tell you. If there’s a link in the text, write down the full URL without tapping it. Carriers and investigators trace messages by sender information, so these details are what turn a report into something usable.
Forward the Text to 7726
7726 spells SPAM, and it’s a universal spam-reporting short code supported by most major U.S. wireless carriers. Copy the body of the scam text and forward it to 7726. Your carrier uses that data to identify patterns, update spam filters, and sometimes block the originating number from the network entirely.1Federal Trade Commission. How to Recognize and Report Spam Text Messages
You’ll usually get an automated reply confirming the report. Some carriers follow up with a second text asking for the sender’s phone number — reply to that one too. It ties the message content to a specific originating line and completes the report.
Use Your Phone’s Built-In Spam Report
Both iPhone and Android have native spam-reporting tools that skip the copy-and-forward step.
On iPhone, a “Report Spam” link appears at the bottom of any message from someone who isn’t in your contacts. Tap it, then confirm with “Delete and Report Spam.” That sends the message and sender info to Apple and your carrier and removes the conversation from your inbox.2Apple. Report Spam and Block Senders in Messages on iPhone
On Android, open the conversation in your Messages app, tap the three-dot menu, and select the report-spam option. That blocks the sender and sends technical data to improve spam detection across the platform.
These tools improve filtering on your device and across the platform, but they don’t route reports to federal investigators. Use them alongside 7726 and the federal reports below, not instead of them.
File Complaints With Federal Agencies
Three federal agencies handle different pieces of the smishing problem. File with each that fits.
Federal Trade Commission
Go to ReportFraud.ftc.gov and pick the category that best matches what happened. If nothing fits cleanly, choose “Something Else” and paste the message text into the comments field — but don’t tap any link in the scam text while copying it.3Federal Trade Commission. ReportFraud.ftc.gov – FAQ The FTC doesn’t resolve individual complaints, but every report feeds the Consumer Sentinel Network, a database law enforcement agencies across the country use to spot trends and build cases.1Federal Trade Commission. How to Recognize and Report Spam Text Messages
Federal Communications Commission
File at consumercomplaints.fcc.gov under the “Phone” category. The FCC collects unwanted text complaints under the Telephone Consumer Protection Act. These complaints are shared internally among FCC bureaus and can trigger enforcement investigations, but you won’t get individual follow-up or status updates.4Federal Communications Commission. Filing a Complaint Questions and Answers
FBI Internet Crime Complaint Center
If you lost money or the scam involved identity theft, file at ic3.gov. IC3 is the FBI’s central intake for cyber-enabled crime. Complaints are analyzed and may be referred to federal, state, or local law enforcement.5Internet Crime Complaint Center (IC3). Home Page – Internet Crime Complaint Center (IC3) Don’t wait for a callback. IC3 states outright that it won’t contact you, and any investigation happens at the receiving agency’s discretion.6Internet Crime Complaint Center (IC3). Complaint Form – Internet Crime Complaint Center (IC3) File anyway. Combined with other reports, the data helps the FBI track trends and, in some cases, freeze stolen funds.
Tell the Organization Being Impersonated
Scammers impersonate trusted names because familiarity short-circuits caution. Reporting to the impersonated organization gives its security team the raw data to watch for account breaches and update its threat intelligence. Look up every reporting address independently through the organization’s official website or app. Never use contact information from the suspicious text itself.
IRS and Tax Scams
Forward IRS or Treasury impersonation texts to phishing@irs.gov. Put “IRS” or “Treasury” in the subject line depending on which one was spoofed.7Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages
Social Security Administration Scams
Report SSA impersonation through the Office of Inspector General’s online form at secure.ssa.gov/oig/scam. The form asks for the date, what the scammer said, whether they demanded your Social Security number, and whether you lost money. You’ll create a five-digit security PIN during the process. Memorize it — an SSA OIG investigator may ask for it during follow-up.8Office of Inspector General. Report Scams
Package Delivery Scams
Fake delivery notifications are one of the most common smishing lures. For USPS impersonations, email spam@uspis.gov with the message text pasted in, your screenshot attached, and a note on whether you clicked the link or lost money.9United States Postal Inspection Service. Smishing – Package Tracking Text Scams For FedEx, UPS, or another carrier, check that company’s official security page for the current fraud-reporting address. These change, and the security page is the only reliable source.
Banks and Financial Institutions
Most major banks publish a dedicated fraud-reporting address, often something like spoof@bankname.com or abuse@bankname.com, on their security page. Forward the text or send your screenshot to whatever address appears there. If you handed over login credentials or account numbers, skip email and call the bank’s fraud line right now. When an account is actively compromised, speed matters more than documentation.
If You Already Clicked or Shared Information
Reporting matters, but if you already tapped a link, entered a password, or handed over financial details, damage control comes first. Work in roughly this order.
Enable airplane mode. Disconnecting from the internet stops malware from transmitting data or reaching other devices on your network and buys you time to think.
Call your bank or card issuer if you entered any financial information. The faster you report unauthorized activity, the less you’re liable for. Ask the bank to freeze or close the compromised account and issue new credentials.
Change the password for any account where you entered login details, and change it anywhere else you reused it. Turn on two-factor authentication where you can.
Run a malware scan with a reputable antivirus app, especially on Android. If the phone still behaves strangely — slow performance, unfamiliar apps, unexpected ads — a factory reset may be necessary. Back up your data first if you can.
File an identity theft report at IdentityTheft.gov if the scammer got personal information like your Social Security number, date of birth, or enough data to open accounts in your name. The site walks you through a questionnaire and produces a personalized recovery plan with pre-filled letters and forms. The report also feeds the FTC’s Consumer Sentinel database.10Federal Trade Commission. IdentityTheft.gov
Protect Your Credit and Bank Accounts
If a smisher collected enough information to impersonate you, the fallout can outlast the scam. Two free tools limit what a thief can do with stolen identity data.
Fraud Alerts and Credit Freezes
An initial fraud alert lasts one year and tells creditors to verify your identity before opening new accounts in your name. You only have to contact one of the three credit bureaus (Equifax, Experian, or TransUnion). That bureau is required to notify the other two. If you’ve confirmed identity theft and filed a report at IdentityTheft.gov or with police, you can request an extended fraud alert that lasts seven years. Both are free.11Federal Trade Commission. Credit Freezes and Fraud Alerts
A credit freeze is stronger. It blocks anyone, including you, from opening new credit until you lift it. Freezes require contacting all three bureaus separately. They’re free, and they last until you remove them. If you know your Social Security number was exposed, a freeze is worth the minor hassle of temporarily lifting it when you apply for credit.11Federal Trade Commission. Credit Freezes and Fraud Alerts
Liability Depends on How Fast You Report
Federal law caps how much you owe when a scammer runs unauthorized transactions, but the caps hinge on your reporting speed.
For credit cards, the Fair Credit Billing Act limits your liability for unauthorized charges to $50. You have 60 days from the statement date to dispute the charge.
For debit cards and bank accounts, Regulation E is less forgiving and the clock runs faster. Report an unauthorized transfer within two business days of discovering it, and your liability caps at $50. Wait longer than two days but report within 60 days of your statement, and you can be liable for up to $500. Miss the 60-day window entirely, and there’s no federal cap on what you can lose after that date.12eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers
Credit card fraud stings, but the $50 cap keeps it survivable. Debit card fraud reported late can drain a checking account with no federal recourse. If a smishing scam touched your debit card or bank login, report it the same day you notice.
Suing the Sender Under the TCPA
Beyond government enforcement, the Telephone Consumer Protection Act gives you a private right to sue the sender of illegal text messages in state court. Win, and you can recover $500 per violation — per message — or your actual losses, whichever is greater. If the court finds the sender acted knowingly or willfully, the judge can triple that award to $1,500 per message.13Office of the Law Revision Counsel. 47 US Code 227 – Restrictions on Use of Telephone Equipment
Small claims filing fees vary by jurisdiction but usually run a few dozen dollars. The harder problem is identifying and serving the actual sender, which is why documentation matters. Screenshots, carrier confirmations, and the reference numbers from your federal complaints all become evidence. Keep every confirmation you get from the reports above. Even if you never file suit, that paper trail strengthens any insurance claim, bank dispute, or law enforcement investigation that comes later.