Guides

How to spot a scam text: 6 warning signs, the common fakes, and what to do

Scam texts arrive on every phone, iPhone or Android, and they are written to make you act before you think. The good news: they almost all follow the same pattern. Learn the six signs below, practice once where a wrong tap costs nothing, and most fake texts become easy to spot.

The one rule

If a text asks you to tap a link, call a number, reply, send a code or pay, and you were not expecting it, stop. Do not use anything in the message. If you think it might be real, contact the company yourself, using the app you already have, the number on your card, or a website you type yourself.

Six warning signs

1It is in a hurry

"Today only", "within 24 hours", "your account will be closed". Real companies rarely give you minutes to act by text. Hurry is there to stop you from asking someone.

2It wants you to tap a link

The link is the trap. It opens a page that looks like your bank, the post office or a toll road, and asks for a card number or a password. Never tap a link to "check" if a text is real.

3It asks for a code

A code sent by text is the key to one of your accounts. No bank, store or government office will ever ask you to read it back to them. Anyone who asks is a scammer. Practice the rule: never share a code.

4You did not expect it

A package you did not order, a toll road you did not drive on, a prize you did not enter for. If nothing you did explains the message, that is your answer.

5The sender looks odd

A strange number, a short number like 89225, an email address instead of a phone number, or a name that is not in your contacts. Real companies can text from short numbers too, so this sign alone is not proof, but together with the others it is.

6Something is slightly off

Spelling mistakes, an odd greeting ("Dear customer"), a web address with extra words or numbers in it, or a tone that does not sound like the company or the person.

The fake texts people get most

These examples are invented, but they follow the patterns of real scam texts. Do not tap links like these in a real message.

The package on hold

From 89225Your package is on hold due to an incomplete address. Update your details within 24 hours: [link]

Signs: hurry, a link, and you may not be expecting a package. Delivery companies show your parcel in their own app or website: check there.

The unpaid toll

From an unknown numberFinal notice: you have an unpaid toll balance of $6.99. Pay now to avoid a late fee: [link]

Signs: a small amount (so it feels harmless), hurry, a link. If you did use a toll road, check your balance on the toll service's own website, typed by you.

The bank alert

From an unknown numberYour account has been locked for unusual activity. Verify your identity here: [link]

Signs: fear, hurry, a link. Call the number on the back of your card, or open your bank's own app. The SafePC lesson a fake message from "your bank" shows the same trick by email.

"Hi Mom, this is my new number"

From an unknown numberHi Mom, I dropped my phone, this is my new number. Can you help me pay a bill today?

Signs: a new number, a money request, hurry. Call your son or daughter on the number you already have, or ask a question only they would know. A real child will understand.

The code someone "sent by mistake"

From an unknown numberSorry, I sent my verification code to you by mistake. Can you send it back to me?

Signs: a code. That code was sent to unlock one of your accounts. Never send it to anyone.

What to do with a scam text

• Do not tap the link, call the number in it, or reply. Not even "STOP": a reply tells the sender your number is real.
• Report it as junk or spam in your messages app. On many phones you can also report and block the sender in one step. This is exactly what the SafePhone lesson spot a scam text message practices.
• You can also forward the text to 7726 (it spells SPAM), which most U.S. mobile carriers use to collect scam texts.
• Delete it.
• If it was about a real account, check that account the safe way: the app you already have, or the number on your card.

If you already tapped, or answered

It happens to careful people too. Act calmly and quickly:

• Close the page. Do not type anything more on it.
• If you typed a password, change it from the real app or website. If you used the same password elsewhere, change it there too. (Practice: reset a password.)
• If you gave card or bank details, call the number on the back of your card now and tell them.
• If you sent a code, contact the company the code was for and say someone may have your account.
• Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.
• Tell a family member. Scammers count on embarrassment; talking about it is how others avoid the same trap.

Practice once, where a wrong tap costs nothing

Reading the signs helps; seeing one on a screen and doing the right thing helps more. SafePhone, our pretend smartphone, runs in the web browser on a computer, tablet or phone. In the lesson spot a scam text message, a fake "package on hold" text arrives from 89225: you read the warning, then report and block it. Nothing in SafePhone is real: no real texts, links or payments, so a wrong tap costs nothing.

Related lessons on the phone: never share a code, spot a scam website, check a QR code before you open it, close a fake virus warning and decline a call from an unknown number. On the computer (SafePC): spot a scam email, someone asks for your code, spot a fake store and report a fake profile and block it.

The steps of every lesson are free to read on these pages. Practicing the scam lessons inside SafePhone or SafePC is part of Pro; the first 5 lessons on each device are free, with no card, so you can see how it works first.

Helping a parent? Our guide on how to teach an older parent to use a smartphone puts scam texts on day 5 of the first week, and explains why not to wait.

Questions people ask