Your phone buzzes. “Your package could not be delivered. Confirm your address.”

Or maybe it says your bank account has been locked, an unpaid toll needs immediate attention or there's a problem with your Amazon account. There's a link underneath.

What should you do? Probably nothing.

Fake text messages have become an incredibly common way for scammers to get people to hand over passwords, credit card numbers and other personal information. They're called “smishing” attacks — essentially phishing scams delivered through SMS text messages.

And they're getting harder to spot.

Years ago, scam messages were often easy to recognize. They contained terrible spelling, strange wording and ridiculous promises from someone claiming you had suddenly inherited millions of dollars.

Today's scams can look surprisingly legitimate.

A message may appear to come from a delivery company and tell you a package couldn't be delivered. Another may claim to be from your bank's fraud department. You might receive a message about an unpaid road toll or a subscription that's about to renew.

The scammer doesn't necessarily know you bank with that particular bank or are expecting a package. They're playing the odds.

Send enough fake package notifications and eventually one reaches someone who really is waiting for a package. That's when the scam becomes convincing.

Don't Click the Link

This is the simplest rule to remember: If you receive an unexpected text asking you to click a link, don't click it.

That doesn't mean the message is definitely fake. It means you should verify it another way.

Suppose you receive a message claiming there's a problem with a package from UPS or FedEx.

Instead of clicking the link, close the message. Open the company's official app or type the company's website into your browser yourself and check the tracking information there.

The same applies to your bank. If a text says there's suspicious activity on your account, don't use the link in the message. Open your bank's app or call the number printed on the back of your debit or credit card.

If the warning is legitimate, you'll still be able to deal with it.

Watch for Urgency

Scammers don't want you to stop and think. That's why their messages frequently create urgency.

“Your account will be closed.” “Payment required immediately.” “Your package will be returned.” “Final notice.”

That little feeling of panic is exactly what the scammer wants.

When a message makes you feel like you need to act immediately, that's actually a good reason to slow down.

Take 30 seconds and ask yourself: Was I expecting this message? Is there another way I can verify it?

Look Closely at the Address

Sometimes the link itself provides a clue. A scammer may create a website address that looks similar to a legitimate company but isn't quite right.

The company name might be followed by additional words, numbers or unusual characters.

But don't rely solely on your ability to recognize a bad web address. Scammers can create convincing-looking links and websites.

It's safer simply not to use the link from an unexpected text at all.

Go directly to the company instead.

Don't Trust a Familiar Name

There's another problem: A text can appear to come from someone you know.

Imagine receiving this: “Hey Dad, I dropped my phone and had to get a new number. Can you text me back?”

The conversation that follows might eventually involve an emergency and a request for money.

Before sending anything, call the person using the phone number you already have saved for them.

The same principle applies if a friend, employee, coworker or family member suddenly asks you to send money, buy gift cards or provide sensitive information in an unusual way.

Verify the request using a second method.

Never Send a Verification Code to Someone Else

This one is especially important.

Sometimes a scammer will attempt to log into one of your accounts using your email address or phone number. The real company then sends you a legitimate verification code.

The scammer contacts you and asks for that code. Don't give it to them.

If you receive a verification code you didn't request, someone may be trying to access your account.

A legitimate security code is generally intended for you to enter directly into the service that sent it — not to read aloud or text to another person.

What If You Already Clicked?

Don't panic. Simply clicking a suspicious link doesn't automatically mean someone has stolen everything on your phone.

The bigger concern is what happened after you clicked.

Did you enter your password, provide a credit card number or download something?

If you entered a password, go directly to the legitimate website and change that password immediately. If you use the same password elsewhere, change it there too.

If you entered financial information, contact your bank or credit card company using its official phone number and explain what happened.

And if you downloaded an unfamiliar app or software, stop using it until you know what it is.

Remember One Simple Rule

You don't need to memorize every scam circulating online, know how hackers work or become most technologically savvy person in your family.

Just develop one habit: Don't let a text message decide where you go next.

If your bank texts you, go to your bank yourself.

If Amazon texts you, open Amazon yourself.

If a delivery company texts you, check your package yourself.

And if your grandson suddenly texts from a mysterious new number asking for $500 in gift cards? Maybe give him a call first.

Thirty seconds of skepticism can save you from a very expensive click. ■