Spotting Phishing Texts Together: A Family Checklist for Teens and Parents

Why phishing texts are a team problem

Phishing texts (also called smishing) are messages designed to make you tap a link, share a code or hand over a password. They pretend to come from a bank, a game, a school, a delivery firm or even a friend. Scammers rely on one thing: you acting before you think.

The fix is not to be perfect alone. It is to build a habit of pausing and checking together, so nobody feels silly for asking "does this look right to you?"

The 5-point check: S.T.O.P.P.

Use this short checklist on any unexpected message. It works for teens, parents and grandparents alike.

1. Sender: Is it from a number or address you do not know? Official organisations rarely text from a random personal mobile number, and names can be faked, so do not trust the display name alone.
2. Time pressure: Does it say "act now", "last warning" or "account locked"? Urgency is the scammer's favourite tool.
3. Offer or threat: Is it too good to be true (a prize, free currency, a refund) or frightening (a fine, a hacked account)?
4. Payment or private info: Does it ask for a password, a one-time code, card details or a gift card? Real services should not ask for these by text.
5. Paths: Check the link's shape without tapping it. Odd spellings, extra words or strange endings are warning signs. Instead of tapping, open the official app or type the website yourself.

Set up a family routine

A few small agreements make a big difference:

• The "show first" rule: Anyone can share a suspicious text with the family without getting in trouble. Teens are more likely to speak up if they know they will not be punished for a click or a mistake.
• A family code word: If someone texts "Mum, I lost my phone, send money", ask for the code word. Choose something that cannot be guessed from social media.
• Never share codes: Verification codes are like a house key. Nobody legitimate needs you to read one back to them.
• Use the official route: If a message claims to be from your bank, school or game, ignore its link and contact them through the app, website or phone number you already trust.

Practice with a pretend text

Ten minutes at the dinner table can help. Write a fake message together, such as "Your parcel is held, pay a small fee here". Then take turns finding the clues: the pressure, the odd sender, the unexpected request. Spotting red flags in a safe setting makes them easier to notice in real life.

What to do with a suspicious message

• Do not reply, even with "STOP". A reply can confirm your number is active.
• Do not tap links or open attachments.
• Report it using your phone's "report junk" option or your country's official scam-reporting service, then delete it.
• Block the sender.
• Tell someone if you already tapped or shared anything. Speed matters more than embarrassment: change affected passwords, turn on two-factor authentication and contact your bank if payment details were involved.

Videos and reports to learn more

We do not want to send you to unverified links, so here is how to find reliable material yourself.

• Videos: On YouTube, search for "phishing awareness for teens" or "how to spot smishing" and choose videos from official channels, such as national cyber security agencies, consumer protection bodies or your bank. Check the channel name and upload date before trusting the advice.
• Reports and guides (PDF): Look for free downloadable guides on phishing from the UK National Cyber Security Centre (ncsc.gov.uk), the US Federal Trade Commission (consumer.ftc.gov), Get Safe Online (getsafeonline.org) and the National Cybersecurity Alliance (staysafeonline.org). Search each site for "phishing" and download the PDF if one is offered.

The takeaway

Scammers want you rushed, isolated and embarrassed. A calm pause, a quick checklist and someone to ask take away all three. Next time a strange text lands, do not tap. Stop, check, and show someone.