Despite many warnings from the FBI and police across the U.S., iPhone and Android users continue to fall victim to text message attacks every day. These attacks steal money, personal data, and even identities.
Organized crime groups from China, such as Smishing Triad and Panda Shop, have developed large-scale text message scams that now affect nearly every city and state in the U.S.
The attacks started with fake messages about undelivered packages, but now unpaid toll texts are the biggest threat. Many Americans have seen FBI and police warnings, but the scams still work and still trick many people.
Authorities from New York, Florida, California, and the FCC say: “Toll operators usually don’t use text messages to collect overdue payments and don’t use threatening language.” If you get a text about an unpaid toll, assume it’s a scam. Contact the toll operator only through official, public channels, then delete the text immediately, as the FBI advises.
These attacks are not stopping. The next wave is expected to target banking customers with fake texts pretending to come from financial institutions. These messages will likely use richer media formats like RCS and iMessage, making them more realistic and harder to detect.
Experts warn one attacker can send up to 2 million smishing messages per day, targeting up to 720 million people per year — enough to reach every person in the U.S. twice yearly.
Some signs of these scams include links with Chinese top-level domains like .TOP or .XIN or websites that mimic real ones by adding subtle changes like “com-” instead of “.com.”
To stay safe, always assume texts about undelivered packages, unpaid tolls, compromised passwords, or suspended accounts are scams. Never reply, never click links, and always delete these messages.
