On this page
If an unexpected text asks you to pay, sign in, or share a verification code, leave its link alone. Open the relevant company's app or contact it using a number you already trust. That simple detour defeats many text scams.
Scam texts, often called smishing, borrow the appearance of ordinary notifications. You do not need to identify every trick perfectly; you need a safe routine for handling requests that arrive without warning.
Know the common stories
Delivery scams claim a package has an incomplete address or needs a small redelivery fee. The amount may seem harmless, but the payment page can collect your card details and personal information. Check tracking through the retailer or carrier's official app instead.
Toll and parking scams demand immediate payment to avoid penalties. Do not assume a message is genuine because you recently drove on a toll road. Visit the relevant agency's known website independently and check your account or vehicle information there.
Fake bank alerts ask you to confirm a purchase, call a supplied number, or move money into a “safe” account. Real fraud monitoring exists, which makes the disguise convincing. Call the number on your card rather than following the text's instructions.
Other familiar setups include these:
- Prize or refund offers: You must pay a fee or supply financial details to receive money.
- Job offers: A recruiter promises easy pay, then asks for deposits, equipment payments, or paid tasks.
- Account warnings: A service threatens suspension unless you sign in through a link.
- Family emergencies: Someone claims to have a replacement phone and urgently needs money.
A message can mention your name or a real company and still be fraudulent. Personal details are not proof of identity.
Watch for conversations that build slowly
Not every scam begins with a link. A wrong-number message may turn into friendly conversation, then an investment pitch. The sender may apologize, keep chatting, and eventually recommend a trading app or cryptocurrency platform.
The danger is the relationship being constructed, not simply the first message. Screenshots of profits, group-chat testimonials, and small initial withdrawals do not prove an investment is legitimate.
Do not send money to recover supposed investment earnings or unlock a withdrawal. Additional “taxes” and “verification deposits” can be another stage of the same scam.
Family impersonation can also happen gradually. Verify an emergency by calling the person's established number or another trusted relative. A familiar photo, writing style, or voice message is not sufficient on its own.
You do not owe an unknown sender a reply. Continuing a conversation can confirm that your number reaches a responsive person and creates more opportunities for persuasion.
Use a safe check before acting
A short checklist is more reliable than guessing from spelling or the phone number. Criminals can write polished messages, and the sender information shown on your phone is not dependable proof.
- Ask whether you expected this request and whether it makes sense in context.
- Avoid the link, attachment, QR code, and callback number in the message.
- Open the organization's official app or type a known web address yourself.
- Check for the same issue inside your account, or call an independently verified number.
- If you cannot verify it, leave the request unanswered and report it.
A short code or an existing message thread does not guarantee safety. Likewise, HTTPS on a linked page means the connection is encrypted, not that the operator is trustworthy.
For a closer look at misleading web addresses and urgency tactics, read How to Spot a Phishing Email in 30 Seconds. The same checks apply when the message arrives on your phone.
Report and block on your phone
Save a screenshot first if you lost money, disclosed information, or need to report an incident at work. Capture the sender, message, and time without opening suspicious links.
iPhone
In Messages, use Report Junk when it appears for an unknown sender. Follow the prompts to report and delete. Availability depends on your carrier, region, and message type.
To block a sender, open the conversation, tap the sender at the top, open their information, and choose Block Caller or the equivalent blocking option. In Settings > Apps > Messages, look for unknown-sender screening or filtering controls; labels vary by iOS version.
Android
In Google Messages, touch and hold a conversation, then choose the blocking or spam-reporting option. You can also open a conversation's menu and look for Block & report spam. Other messaging apps may place these controls elsewhere.
Many US carriers accept spam texts forwarded to 7726, which spells SPAM. Follow your carrier's prompts. You can also report fraud at ReportFraud.ftc.gov.
Blocking helps with that sender, but scammers rotate numbers. Filtering and independent verification remain important. Do not reply STOP to an obvious scam; reserve unsubscribe replies for legitimate services you recognize.
If you clicked or shared information
Merely opening a link does not automatically mean your phone is compromised. Close the page, avoid downloads and permission requests, and update your browser and operating system. Take stronger action based on what happened next.
If you entered a password, change it through the official service. Change reused copies too, and review signed-in devices and recovery settings. A Password & Hash Generator can help create a unique replacement; do not enter an existing secret into a tool to check it.
If you shared a sign-in code or approved an unexpected authentication prompt, treat the account as potentially accessed. Start recovery immediately rather than waiting for visible damage.
If you submitted card or bank details, contact the institution using its official app or the number on your card. Explain exactly what you shared. Ask about blocking transactions or replacing the card, and monitor statements.
If you installed an app, configuration profile, or remote-access software at the sender's direction, stop interacting with them and get trusted technical help. Work devices should go to your IT team. For exposed Social Security numbers or identity documents, IdentityTheft.gov provides a recovery plan.
Keep the response simple
Do not argue with the sender or pay someone who promises guaranteed recovery. Save useful evidence, report the message, and handle any real account problem through an independent channel.
For ongoing protection, use unique passwords and follow How to Turn On Two-Factor Authentication Everywhere. A pause before responding is often your strongest first defense.
Reach designers & developers at work
Put your product next to the tools people use every day. One sponsor per placement, no tracking pixels.
Become a sponsor