Text message scams are forms of smishing that use SMS, iMessage, RCS, or another messaging service to steal money, information, or account access. This guide focuses on the scam stories most often delivered by text and the correct response to each one. Do not use a link, phone number, or payment instruction in an unexpected message to verify that same message.
Common text message scams
Fake bank fraud alerts
A message asks whether you approved a purchase and invites a reply or call. A scammer then poses as the bank, collects a security code, or tells you to move money. Open the bankâs real app or call the number on your card.
Package and USPS impersonation
The text claims that a delivery cannot be completed until you update an address or pay a small fee. The linked page may collect card and identity information. Check the order or tracking number through the seller or carrier site you reach independently.
Unpaid toll and traffic notices
A message threatens a fine, license action, or extra charge over a small unpaid balance. Visit the state or local agencyâs official website without using the text link.
Job and task scams
An unexpected recruiter offers remote work, simple online tasks, or high pay with little screening. The scheme may request personal information, ask you to deposit a check, or require your own money to unlock earnings. A legitimate employer does not charge applicants to get paid.
Prize, reward, and survey texts
The sender offers a gift, refund, or expiring points, then asks for a shipping fee or card number. A prize that requires payment is not a prize.
Wrong-number conversations
A stranger starts with an innocent mistake and continues the conversation. Over time, the person may introduce an investment, romance, or financial opportunity. Stop engaging when a wrong-number contact steers toward money or private accounts.
Account verification codes
Someone asks you to repeat a code sent by Google, WhatsApp, a bank, or another service. The code may approve a login, password reset, or new account linked to your number. Never give an unsolicited caller or texter a security code.
How to check whether a text is real
- Stop before using anything in the message.
- Identify the claimed company, account, order, or event.
- Open the official app or type a known website address.
- Review the account for the same alert.
- Contact the person or organization through a known channel if the event is still unclear.
A company may send legitimate texts. The independent account check is what separates a valid notification from a copied message.
What not to do
Do not click an unexpected link, call the supplied number, reply with personal information, pay a fee, or install an app. Do not assume a message is real because it contains your name, appears in an old thread, or uses a familiar short code.
Private browsing does not make a fraudulent page safe. HTTPS protects the connection to a destination but does not establish that the destination belongs to the claimed company.
How to block and report scam texts
Use the report-junk or block option in the messaging app. Forward the message to 7726 (SPAM) when your carrier supports it. Report fraud and attempted fraud at ReportFraud.ftc.gov. A government or company being impersonated may also have its own reporting channel.
Keep the message, sender information, URL, and screenshots when money, identity information, or account access is involved. Evidence can help a provider or investigator understand what happened.
What to do after interacting with a scam text
If you clicked but entered nothing, close the page, remove unexpected downloads or permissions, update the device, and run a trusted security check. If you submitted information, secure the affected account or financial product directly.
Change exposed and reused passwords, end unfamiliar sessions, and enable two-factor authentication. If you shared card or bank details, contact the financial institution. Use IdentityTheft.gov when identity information may be misused. If you sent money, contact the payment provider immediately.
How dfndr security can help
The URL Checker can analyze an address for some known malicious signals. Complete Antivirus can identify certain harmful apps and files. Breach Report can alert users when credentials associated with a registered email address appear in known breach data.
These controls address technical and credential risks. They do not prove that a sender, delivery, toll, job, purchase, or emergency story is legitimate.
Frequently asked questions about text scams
Why do scammers know my name or order details?
Information may come from public sources, marketing data, compromised accounts, or data breaches. Correct details make a story more convincing but do not authenticate the sender.
Can replying make things worse?
Replying may confirm that the number is active or begin a conversation designed to collect more information. Report and block a suspicious message without engaging.
Are texts from five- or six-digit short codes safe?
Short codes are used by legitimate organizations, but sender presentation can still be misleading. Verify sensitive requests inside the official account.
Is a tiny payment safe?
No. A small delivery or processing fee can expose card details and may enroll the victim in later charges. Confirm the fee through the real service.
Can a URL checker confirm the sender?
No. It evaluates the address within its technical scope. It does not validate the sender or the messageâs claim.