Don’t Take the Bait: Protect Yourself from Text and Phone Scams

What are smishing and vishing scams?

Smishing (text message scams)

Smishing combines "SMS" (text messaging) and "phishing." These scams arrive as text messages that appear to come from trusted organizations or familiar services you may use regularly, such as banks, government agencies, delivery companies or online retailers.

The message often creates a sense of urgency and may ask you to click a link, verify account information or resolve an issue immediately. In reality, the goal is often to collect sensitive information or direct you to a fraudulent website.

Vishing (voice call scams)

Vishing, or voice phishing, happens by phone. Scammers may pose as representatives from a bank, government agency, technology company or other trusted organization.

These calls can be especially convincing because scammers often use caller ID spoofing technology, making it appear as though the call is coming from a legitimate source. They may pressure you to act quickly, provide personal information or move money to a supposedly "safe" account.

Key takeaway: Smishing and vishing scams don't rely on breaking into computer systems. They rely on creating trust, urgency and emotional reactions that encourage people to act before thinking things through.

Why these scams work (and why anyone can fall for them)

It's easy to assume scams only affect people who aren't paying attention. In reality, scammers are skilled at creating situations that feel legitimate and require immediate action.

Many scams are designed to trigger emotions such as fear, concern, excitement or curiosity. A message claiming your account has been locked, a package can't be delivered, or suspicious activity has been detected can make anyone want to respond quickly.

Scammers also imitate the communication channels and organizations people interact with every day. When a text or call looks familiar, it can be harder to spot the warning signs.

The important thing to remember is that these tactics are designed to manipulate human behavior. That's why staying informed and recognizing common patterns can make such a difference.

Warning signs to watch for

Red flags in text messages (smishing)

Be cautious if you receive a text message that:

• Unexpectedly asks you to click a link or verify information
• Includes a shortened, unfamiliar or suspicious web address
• Creates urgency with phrases like "Act now," "Immediate action required" or "Account locked"
• Promises rewards, refunds or prizes that seem too good to be true
• Appears to come from a trusted organization but directs you to an unfamiliar website or phone number

Red flags in phone calls (vishing)

Beware of callers who:

• Claim to represent a trusted organization, such as a bank or government agency, then pressure you to share information, authorize transactions or grant account access
• Ask for sensitive information like passwords, PINs, one-time passcodes or account numbers
• Pressure you to act immediately or create a sense of urgency
• Request that you transfer funds, purchase gift cards or make payments
• Insist on staying on the line while you complete a transaction
• Pressure you to stay on the line instead of contacting the organization yourself

And remember: don't rely on caller ID alone. Scammers can make calls appear to come from trusted organizations—even when they don't.

Universal warning signs

Whether the contact comes through text or a phone call, common warning signs include:

• Requests for personal or financial information
• Messages or calls from unknown numbers
• Attempts to create urgency or panic
• Unexpected account-related notifications
• Impersonation of trusted organizations or individuals

When in doubt, take a moment to pause and verify before responding.

Simple ways to protect yourself

Pause before you respond

One of the simplest and most effective defenses is taking a moment to slow down.

Scammers count on quick reactions. If a message or call demands immediate action, pause and evaluate the situation before responding, clicking a link or sharing information.

Verify through official channels

If a message or caller claims to represent a company or organization, verify the request independently.

Instead of using a phone number or website provided in the message, look up the organization's contact information yourself and reach out directly.

Don't share sensitive information

Legitimate organizations generally won't ask for passwords, security codes or other sensitive credentials through text messages or unsolicited phone calls.

If someone requests this information unexpectedly, treat it as a warning sign.

Use built-in protections

Technology can help support your efforts. Consider:

• Enabling multifactor authentication (MFA) on your accounts
• Using spam-filtering features on your mobile device
• Taking advantage of call-blocking tools when available
• Keeping your devices and apps updated

Trust your instincts

Sometimes your best defense is your own judgment.

If a message feels rushed, unusual or simply doesn't seem right, trust your gut. Taking a few extra minutes to verify can help you avoid a much bigger problem later.

What to do if you receive a suspicious message or call

If you receive a text or phone call that feels fishy, don’t take the bait.

• Don't click links, respond to messages or share personal information.
• Block the number when possible.
• Report the message or call through your device or service provider.
• Monitor your accounts for unusual activity.
• Contact your bank directly if you're unsure whether a communication is legitimate.

Key takeaway: Cybercriminals don’t hack systems—they hack people. Learn what they’re after and the key things your bank will never ask, so you can spot scams and stay safe.

What to do If you think you've been targeted or scammed

If you've already clicked a suspicious link, shared information or believe you've been targeted by a scam, there are steps you can take to help protect yourself.

Start by securing any affected accounts. Change your passwords, enable multifactor authentication (MFA), if available, and review account activity for anything unusual. If financial information may have been compromised, contact your bank using a trusted phone number and let them know what happened.

It's also a good idea to monitor your accounts and transactions for suspicious activity and report any unauthorized activity as soon as possible.

Remember: Anyone can be targeted by a scam. Scammers are skilled at making their messages and requests look legitimate, which is why even the most cautious people can be caught off guard. If you think you’ve been affected, don’t panic. Stay calm, take a moment to assess the situation, verify what happened and follow the appropriate steps to protect your accounts, personal information and devices.

Stay one step ahead of scammers

Scams will continue to evolve, and fraudsters will keep finding new ways to reach people. But while the methods may change, the underlying tactics often remain the same: creating urgency, building trust and encouraging quick decisions.

When you understand these patterns, a suspicious text or unexpected phone call becomes easier to recognize for what it is.

Awareness is one of the most effective tools you have—and it can help you navigate digital communication with greater confidence.

Stay informed and stay secure

You don't need to be a cybersecurity expert to protect yourself from scams. A healthy dose of awareness, a willingness to verify information and a habit of slowing down before responding can make a meaningful difference.

The next time you receive an unexpected text, phone call or request for sensitive information, take a moment to confirm it's legitimate through official channels before taking action.

Associated Bank has your back. If you ever have questions or concerns, don’t hesitate to contact us directly or visit our Security Help page for more stay-safe guidance and resources.