How to Tell a Real Retailer Text Alert From a Phishing Scam
Learn the consent, ID, and opt-out checks that separate store alerts from smishing, plus safe ways to verify orders.
A real retailer text arrives only after you agreed to receive messages, names the brand, and explains how to stop messages by replying STOP. A phishing text is usually unexpected, mentions an order you never placed, and pushes you to click, call, or share details. Smishing means phishing by text message.
It impersonates a trusted store or delivery carrier and uses urgency to get a fast response.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 02, 2026.
What does a real store text include?
A legitimate marketing text requires your prior consent. It must identify the brand and explain how to opt out, such as replying STOP, according to the CTIA in the CTIA messaging guidance. If you never signed up, treat the message with doubt.
Real order and shipment alerts also point you back to your own account. Check the order in the retailer or carrier app, or type the site address yourself. An unexpected note about an order you never placed points toward fraud.
How does a phishing text try to rush you?
Phishing texts borrow a familiar company name and tell a story that demands fast action. Common stories include an account problem, missed delivery, unpaid fee, refund owed, or free coupon or prize. The goal is to make you click, call, or share data before you think.
Look for urgent language, requests for personal or payment details, and shortened links you cannot verify. Those signals matter because smishing messages often contain a link, email address, or phone number that opens a browser, message window, or dialer. Legitimate companies will not ask for account details by text, the Federal Trade Commission explains in How to Recognize and Report Spam Text Messages.
How can you check an order without clicking?
Do not use the link, phone number, or callback in the message. Instead, open the retailer or carrier app yourself and enter the order or tracking number there. You can also type the company site address directly into your browser.
This separate check helps with delivery texts too. A package text with a link that you did not request deserves extra care, since requested tracking texts from the postal service will not contain a link. One safe habit covers many cases:
- Pause the urge to click or reply.
- Find your order number from your receipt or account.
- Enter it only in the app or site you opened yourself.
What should you do with a suspicious text?
Do not reply to a questionable text. Forward it to 7726 to alert your carrier, then delete the message and block the sender, as described by the Federal Communications Commission in Stop Unwanted Robocalls and Texts. Report fraud to ReportFraud.ftc.gov, and send questionable postal texts to [email protected].
Blocking and reporting reduce these messages but cannot stop every one. Senders rotate numbers and links and can fake sender names, so keep checking each unexpected alert in your own account rather than trusting any single clue.