Victor Sterling, MS, CHDA
Patient Rights Advocate & Medical Fraud Prevention Specialist
You are sitting at the kitchen table when your smartphone buzzes. You glance down and see a text message: “CVS Notice: Your prescription order #8849 is on hold due to a billing error. Please update your payment method immediately to avoid cancellation: [Link].” If you are one of the millions of Americans waiting on a critical refill for heart medication or insulin, your chest immediately tightens. Without thinking, you tap the link.
In that single tap, you haven’t fixed a pharmacy error—you have just walked straight into a digital ambush.
Welcome to the world of “Smishing” (SMS Phishing). Cybercriminals have realized that seniors have grown highly suspicious of random phone calls, but they are still highly trusting of text messages, especially those regarding their healthcare. Here is how this predatory psychological trap works, how to spot the red flags instantly, and what to do to protect your identity and your bank account.
💡 Insider Tip: The “Numbers Game” Illusion
If you receive a text claiming to be from Walgreens, you might think, “How did they know I use Walgreens?” They didn’t. Scammers buy lists of millions of phone numbers and blast the same text to everyone. Because Walgreens and CVS control a massive share of the U.S. market, statistically, the scammer is bound to hit thousands of actual customers purely by coincidence.
1. The Psychology of the Scam: Urgency and Fear
Scammers are master manipulators of human emotion. They know that your medication is your lifeline. By claiming your prescription is “delayed,” “canceled,” or “requires signature,” they manufacture an artificial medical emergency.
When you click the link in the text message, it does not take you to the real pharmacy’s website. Instead, it directs you to a highly sophisticated, perfectly forged “spoof” website. The fake site will display the exact logos, colors, and fonts of your trusted pharmacy. It will prompt you to enter your date of birth, your Medicare number, or your credit card information to “resolve the billing issue.”
Once you hit submit, the scammers instantly capture your data and sell it on the dark web or use it to drain your bank accounts.
If you ever receive a concerning text, do not click the link. Walk into your local pharmacy or call them directly to verify the status of your medication.
2. Spotting the Digital Red Flags
Fortunately, these scams are rarely perfect. If you pause for just five seconds and look closely at the text message, the facade usually crumbles. Watch for these three unmistakable red flags:
- The “Garbage” URL: Look closely at the website link inside the text message. A real pharmacy will use a clean URL (like CVS.com or Walgreens.com). Scammers use complex, jumbled links (like rx-update-portal-88.com) or URL shorteners (like bit.ly/3xYqz) to hide their true destination.
- A Full 10-Digit Phone Number: Major corporations do not send automated alerts from standard 10-digit cell phone numbers (e.g., 555-867-5309). Legitimate pharmacies use “Short Codes”—special 5 or 6-digit numbers dedicated to automated corporate messaging.
- The Demand for Payment Details: If you have been picking up medication at your local pharmacy for years, they already have your insurance and payment profile on file. Legitimate pharmacies will never text you a direct link demanding you type in a full 16-digit credit card number to release a medication.
3. The “Delete and Verify” Protocol
To completely immunize yourself against these attacks, you must adopt a strict behavioral rule for your smartphone: Never log into an account by clicking a link in a text message.
The Safe Verification Checklist
- 1️⃣Ignore the Text. Do not reply to the message. Even texting “STOP” alerts the scammers that your phone number is active and monitored, which will lead to even more spam.
- 2️⃣Use the Official App. Close your text messages. Open the official pharmacy app (which you previously downloaded securely from the App Store) or manually type the pharmacy’s real website into your browser. If there is a legitimate billing issue, there will be a bright red alert banner waiting for you inside your secure account.
- 3️⃣Call the Pharmacy. Call the local phone number printed directly on your orange prescription bottle. Ask the pharmacist, “Did you just send me a text about a delay?” 99% of the time, they will tell you your prescription is fine and to delete the text.
4. What to Do If You Already Clicked the Link
If you clicked the link and entered your information, take a deep breath. Panic is the enemy. Act immediately to secure your assets:
If you entered a credit card or debit card number, call the toll-free number on the back of your card immediately. Tell the fraud department you fell victim to a phishing scam and need the card frozen and reissued. If you entered your Medicare number, call 1-800-MEDICARE to report a compromised Beneficiary Identifier, and they will issue you a new card to prevent fraudulent medical billing. Finally, change the password to your online pharmacy account.
The Bottom Line
We are living in an era where cybercriminals view seniors as lucrative targets. They rely on the assumption that you will be too scared about your health to notice their digital traps. You can completely disarm them by breaking the cycle of urgency. Never let a flashing screen dictate your actions. Treat every unsolicited text message as hostile until proven otherwise. By taking 60 seconds to verify an alert through official channels, you guarantee that the only thing you pick up from the pharmacy is your medication—not a stolen identity.