Most phishing texts share three tells.
1. Urgent stakes, vague details. "Your package is held" — but which package? Real couriers reference a tracking number you already have. If the message is generic, it's probably bait.
2. A link that doesn't match the brand. Long-press the link (don't tap). If the domain isn't the company's, delete the message. Scammers love look-alikes: amaz0n-help.co, paypal-secure.app.
3. A request for information the sender should already have. Your bank won't ask you to "confirm" your full card number, PIN, or one-time code over text. Ever.
When in doubt, run it through HackFirstAid's "Is this a scam?" tool — it tells you in seconds and walks you through what to do next.