Can You Really Get Hacked From a Text Message?
Quick Answer
This is one of the most commonly misunderstood security questions. The short answer is: receiving a text does not hack your phone. What matters is what you do with it.
What a Text Message Can and Cannot Do
What it cannot do on its own:
- Install malware or spyware just by being received
- Access your contacts, photos, or banking apps without any action from you
- Compromise your accounts if you do not interact with it
What it can do if you interact with it:
- A link can lead to a phishing page that steals credentials if you enter them
- A link can lead to a malware download (rare on updated phones, requires you to approve the install on Android)
- A phone number can connect you to scammers who use social engineering
- Replying with personal information gives that information to scammers
The Smishing Threat Is Real, But Specific
Smishing (SMS phishing) is a genuine threat. It works through deception, not technical exploitation. Common smishing messages impersonate:
- Package delivery carriers
- Banks and credit card companies
- Government agencies (IRS, Social Security)
- Toll authorities
- Retailers with fake order problems
The goal is always the same: get you to click a link, call a number, or provide information. The text itself is just the delivery vehicle.
Zero-Click Attacks: A Real But Rare Threat
Security researchers have documented "zero-click" exploits, attacks that can compromise a device through a message without any user interaction. These vulnerabilities exist primarily in the underlying software handling message previews.
However, these attacks:
- Require sophisticated, expensive exploit code typically used in targeted surveillance
- Are patched by Apple and Google when discovered (see Pegasus spyware and subsequent iOS updates)
- Are used against specific high-value targets (journalists, activists, executives), not average consumers in bulk attacks
- Are not what happens when your friend forwards you a suspicious link
Keeping your phone's OS updated closes known zero-click vulnerabilities promptly.
How to Handle Suspicious Texts
Do not click links in unsolicited texts from numbers you do not recognise, even if the message looks like it is from a company you use.
Do not call back numbers provided in suspicious texts.
Do not reply with any personal information.
Verify independently. If a text claims to be from your bank, go to your bank's official app or website directly.
Delete and report. Delete the suspicious message. Forward it to 7726 (SPAM) to report to your carrier.
What Happens If You Did Click
If you tapped a link by accident:
- Close the browser immediately if a page loaded
- Do not enter any information on the page
- Check what the URL was, if it does not match the organisation it claimed to be from, treat it as a phishing attempt
- Run a security scan on Android (Google Play Protect or Malwarebytes)
- Monitor accounts linked to whatever service the text was impersonating