The text arrives on a Saturday, while the office is closed and the administrator is in the grocery store checkout line.<\/p>\n\n\n\n
USPS: Your package could not be delivered due to an incomplete address. Update your information within 24 hours: [link]<\/em><\/p>\n\n\n\n She is expecting a package — the new children’s ministry curriculum, ordered Tuesday. The link looks vaguely official. She’s holding a phone in one hand and a gallon of milk in the other. This is precisely the moment the message was designed for.<\/p>\n\n\n\n This is smishing<\/strong> — phishing carried out by text message. The name is a mash-up of SMS<\/em> (the technical name for a text message) and phishing<\/em> (tricking someone into clicking a link or giving up information by pretending to be someone they trust). Same con as the fake email, different doorway. And the doorway matters, because the phone in your pocket gets a level of trust and speed of response that email never did.<\/p>\n\n\n\n Your email has a spam filter that has been learning for twenty years. Your text messages, for the most part, do not. A scam that would never survive the trip to your inbox lands on your lock screen untouched.<\/p>\n\n\n\n The behavior around texts is different too. People answer texts fast — usually within minutes, often mid-task, standing up, one-handed. Nobody prints a text out and walks it down the hall to ask the treasurer if it looks right. And on a phone, the single best defense you have on a computer — hovering over a link to see where it really goes — mostly isn’t available. The screen is small, the address is shortened, and the browser hides the details.<\/p>\n\n\n\n The scale of the problem is not small. The Federal Trade Commission reported that Americans lost $470 million to text-message scams in 2024<\/strong> — five times the losses reported in 2020, even though the number<\/em> of reports went down. Fewer people are falling for it; the ones who do are losing more.<\/p>\n\n\n\n The FTC’s data names the five most common text scams by reported losses. Every one of them maps cleanly onto a week in a church office.<\/p>\n\n\n\n The fake package notice.<\/strong> The most common of all. “Your delivery could not be completed.” A church office receives packages constantly — curriculum, supplies, communion cups, things five different volunteers ordered — so someone<\/em> is always expecting a delivery. That’s what makes it work. The link leads to a page that harvests your address, your card number, or your login.<\/p>\n\n\n\n The bogus job offer.<\/strong> Recruiting texts for part-time, work-from-home positions — sometimes called task scams<\/em>, because they pay small amounts for trivial online tasks before demanding a deposit to “unlock” larger earnings. These circulate through congregations, and they sometimes borrow a real ministry’s name to look credible.<\/p>\n\n\n\n The fake fraud alert.<\/strong> “Did you attempt a purchase of $487.23 at Best Buy? Reply NO to dispute.” There was no purchase. The reply — or the phone call that follows — is the scam. It ends with the “bank” walking the victim through moving money to a “safe account” that belongs to the attacker.<\/p>\n\n\n\n The unpaid toll.<\/strong> A small, plausible amount — a few dollars — with a payment link and a late-fee threat. Small enough to pay without thinking, which is the entire design.<\/p>\n\n\n\n The wrong number.<\/strong> “Hi, is this Jennifer? We’re still on for Tuesday?” It looks like a misdial. Replying politely starts a friendly conversation that, over weeks, becomes a relationship — and eventually an investment opportunity. This one costs its victims the most, and it targets exactly the demographic most churches serve.<\/p>\n\n\n\n For a business, smishing is a consumer problem that occasionally reaches payroll. For a church, it’s stickier, for one structural reason: the phone that receives the scam is almost never a device the organization controls.<\/strong> It’s the administrator’s personal phone, the volunteer treasurer’s personal phone, the youth director’s personal phone — carrying church email, the giving platform app, and the group chat with every leader in it.<\/p>\n\n\n\n That means you cannot solve this with software. There is no filter you can buy for a phone you don’t own. What you can change is the procedure<\/em> — what a person does in the ten seconds after the message lands.<\/p>\n\n\n\n Adopt the two-line text policy.<\/strong> Say it at the next staff meeting, put it in the volunteer handbook, and have leadership repeat it until it’s folklore: We never handle money, passwords, or account changes by text. If a text asks for any of those, it’s fake until proven otherwise by a phone call to a number we already have.<\/em> That single rule defeats every scam on the FTC’s list, because every one of them needs the text itself to carry the action.<\/p>\n\n\n\n Teach the app-not-the-link habit.<\/strong> If a text claims to be your bank, the postal service, or a toll authority, the response is never the link in the message — it’s opening the official app, or typing the address you already know. If the alert is real, it will be waiting there.<\/p>\n\n\n\n Report, then delete.<\/strong> Forward scam texts to 7726<\/strong> — that spells SPAM on a keypad — which helps carriers block similar messages for everyone. Then report it at ReportFraud.ftc.gov, and delete it. Don’t reply, not even “STOP,” to a message you believe is a scam; a reply confirms the number is live.<\/p>\n\n\n\n Warn the congregation once a season.<\/strong> A single line in the bulletin or newsletter — the church will never text you asking for gift cards, payments, or personal information<\/em> — protects the people your staff can’t. The wrong-number romance scam in particular preys on older adults, and a warning from a trusted pulpit lands where a news story doesn’t.<\/p>\n\n\n\n Smishing is the same social engineering we covered on day one of this series<\/a> — persuasion instead of hacking — squeezed into 160 characters. The persuasion doesn’t survive a pause and a phone call. Build the pause into the routine.<\/p>\n\n\n\n Want to know where your organization actually stands? MissionDefend’s free assessment asks plain-English questions about how your church handles email, texts, donations and member data, then gives you a prioritized plan. Join the launch list<\/a> and be first in line.<\/em><\/p>\n\n\n\n Sources:<\/strong> Federal Trade Commission, New FTC Data Show Top Text Message Scams of 2024; Overall Losses to Text Scams Hit $470 Million<\/a> (April 16, 2025); Federal Trade Commission, How To Recognize and Report Spam Text Messages<\/a>; Cybersecurity and Infrastructure Security Agency, Recognize and Report Phishing<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Text scams cost Americans $470 million in reported losses in one year. Here’s how smishing targets church staff, and the two-line policy that stops it.<\/p>\n","protected":false},"author":1,"featured_media":395,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[11,144,12,145],"class_list":["post-402","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threats-scams","tag-phishing","tag-smishing","tag-staff-training","tag-text-scams"],"_links":{"self":[{"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/posts\/402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/comments?post=402"}],"version-history":[{"count":1,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/posts\/402\/revisions"}],"predecessor-version":[{"id":413,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/posts\/402\/revisions\/413"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/media\/395"}],"wp:attachment":[{"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/media?parent=402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/categories?post=402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/missiondefend.com\/blog\/wp-json\/wp\/v2\/tags?post=402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Why texts work when emails fail<\/h2>\n\n\n\n
The five texts your staff will actually receive<\/h2>\n\n\n\n
The church-office wrinkle<\/h2>\n\n\n\n
What to do this week<\/h2>\n\n\n\n
\n\n\n\n