Can someone hack my phone by sending a text message?

Highly sophisticated attacks known as zero-click exploits can compromise certain phones when a specially crafted message is received, without the user clicking anything. These attacks generally target specific individuals using expensive commercial spyware and are not used in typical mass fraud. For most people, the real risk from text messages is smishing: a text that contains a link leading to a phishing site or malware download, requiring the user to take an action. Keeping your phone's operating system and apps fully updated is the best protection against both categories of attack, as updates patch known vulnerabilities. Be cautious about any link in an unexpected text, even from a number you recognise.

Separating the two threat levels prevents both panic and complacency. Zero-click spyware is expensive, targeted at journalists, activists, executives, and officials, and burning such a capability on ordinary fraud makes no economic sense — so for most people it belongs off the worry list. Smishing, by contrast, is industrial: sent in millions, cheap to run, and profitable even at tiny response rates. Your defences should match the real threat, which means link discipline and updates rather than fear of the message itself.

A middle category is worth knowing: texts that try to talk you into installing something. A message urging you to download an app from outside the official store — a 'tracking app', a 'security update', a 'video player' — is attempting to bypass the strongest protection your phone has. Sideloaded malware delivered this way can read messages and capture banking sessions. Simply reading a text remains essentially safe on an updated phone; installing what a text asks for is where compromise actually happens.