Your phone buzzes: "Congratulations! You've been selected to win a $750 Amazon reward. Claim in 24 hours: bit.ly/clm-xxxx." It feels like luck, but it's a script. "Smishing" — SMS phishing — hit an estimated 400 million-plus texts a day at its peak, and prize bait is one of its favorite hooks because winning short-circuits your suspicion. Here's how to read a "you won" text for what it really is before your thumb does the damage. 📱
Real sponsors don't cold-text you a surprise win
Legitimate sweepstakes work off the entries you submitted. That means the sponsor already has a record of you and a defined way to reach winners — usually email, certified mail, or a phone call, spelled out in the official rules you agreed to when you entered. A brand you never gave your number to does not have a channel to text you, and a real win never arrives as a bolt from the blue for a contest you don't remember entering.
Two tells give the con away fast. First, manufactured urgency: "claim in 24 hours" or "reply YES now" exists to stop you from checking. Real prizes give you weeks, in writing. Second, the "sender" is a random 10-digit mobile number or a shortcode you don't recognize — actual brands text from consistent, published numbers. And remember the bright-line rule of every honest sweepstakes: you never pay to receive a prize. Any "small fee," "shipping charge," or "tax deposit" requested by text is a scam, full stop.
Never tap the link — the URL is the whole trap
The entire attack lives in that link, and it's built to hide where it goes. Watch for shortened or masked URLs — bit.ly, tinyurl, or a shortcode that expands into who-knows-what. Watch for lookalike domains that bury the real brand inside junk: amazon-rewards-claim.co, walmart.gifts-us.net, or a .top / .xyz / .info ending no major retailer uses for a prize page. The visible text can even read "amazon.com" while the actual destination is something else entirely.
Tapping is the mistake, not entering info afterward. The landing page harvests logins and card numbers, and on some phones a single tap is enough to load a drive-by page or push a sketchy "claim app." So don't tap to investigate, and don't reply "STOP" either — any response confirms your number is live and sells you into more spam. The safe move is boring: delete it. In the US you can forward the message to 7726 (SPAM) to report it to your carrier, then delete.
Verify independently, using contacts you find yourself
If a sliver of doubt remains — maybe you did enter something — verify through a channel the text never touched. Open a browser and type the brand's real address yourself, or call the number printed on your card or the company's official site. Never call a number or open a link the message gave you; scammers happily staff their own "prize department." The test is simple: could you confirm this win without using anything inside the text? If not, it isn't real.
Trust the pattern over the payout. The prize is dangled precisely to make you skip these steps, so slow down for exactly the messages that excite you most. A genuine sponsor survives a five-minute verification; a scam collapses the instant you look away from its link.
When a "you won" text lands, don't tap — verify it yourself or delete it.