Knowing how to spot a scam text has become a basic survival skill for anyone with a phone. The messages arrive at all hours: an unpaid toll, a package that could not be delivered, a bank alert about a suspicious charge, a friendly “Hi, is this Sarah?” from a number you do not recognize. Most are easy to ignore. Some are convincing enough to fool careful, tech-savvy people.
The losses are real. The Federal Trade Commission says Americans reported losing more than $12.5 billion to fraud in 2024, and scams that began with a text message accounted for hundreds of millions of dollars of that. This guide covers the nine warning signs, the scams circulating most often right now, and exactly what to do if you have already tapped the link.
Table of Contents
Why scam texts work so well
Text messages feel personal and urgent in a way email does not. Most people read a text within minutes, often while doing something else, which is exactly when mistakes happen. A message that says your toll account will be sent to collections tonight is designed to make you act before you think.
Scammers also have better tools than they used to. They can send millions of messages cheaply, spoof sender names, and copy the logos, wording and website designs of real companies almost perfectly. Artificial intelligence now helps them write messages without the spelling mistakes that used to give them away.
The good news is that nearly every scam text follows the same small set of tricks. Once you know them, they become much easier to recognize.
How to spot a scam text: 9 warning signs
Not every scam text shows all of these signs, but most show several.
1. It creates urgency or fear
Your account will be suspended. A fine will double. A package will be returned. Your bank card has been locked. Urgency is the scammer’s most important tool, because panic stops people from checking whether the message makes sense.
2. It asks you to tap a link
The goal of most scam texts is to get you onto a fake website. Real companies do send texts with links, but a message you did not expect, asking you to log in or pay through a link, deserves suspicion.
3. The link looks slightly wrong
Look closely at the web address. Scam links often use misspellings, extra words or unusual endings, such as a toll agency name followed by “-pay” or “-services” and a strange domain ending. A real government agency in the U.S. almost always uses a .gov address.
4. It comes from an unfamiliar number or email address
Many scam texts arrive from random phone numbers, international numbers or even email addresses sent as texts. Banks and delivery companies typically use short codes you have seen before.
5. It asks for payment in unusual ways
Gift cards, cryptocurrency, wire transfers and payment apps like Zelle or Venmo are favorites for scammers, because the money is hard to recover. No legitimate government agency or utility asks you to pay with gift cards.
6. It asks for a code
If someone texts to ask for a verification code that was just sent to your phone, stop. That code is often the key to your account. Real companies do not ask you to read back or forward a one-time passcode.
7. It is about something you did not do
A toll you never drove through, a package you never ordered, a subscription you never signed up for. Scammers rely on the fact that many people will tap just to find out what it is.
8. It starts a conversation with a stranger
“Hi, are we still on for dinner?” or “Sorry, wrong number” can be the start of a long con. These messages aim to build a friendly relationship over days or weeks before introducing an investment opportunity, often in cryptocurrency.
9. It asks you to reply or call a number
Some scams avoid links entirely. They ask you to reply “YES” or “NO” to confirm a charge, or to call a number where a fake customer service agent is waiting. Replying also tells scammers your number is active, which can lead to more messages.
The most common scam texts right now
Scams change with the news and the seasons, but a few types have been especially widespread.
Unpaid toll texts have hit drivers in nearly every state. They claim you owe a small toll, often just a few dollars, and threaten late fees. The FBI’s Internet Crime Complaint Center has warned repeatedly about this scheme. Real toll agencies bill through their own accounts and websites, and you can always check by going to your toll agency’s official site directly.
Package delivery texts claim a shipment is on hold because of an incomplete address or unpaid postage. The U.S. Postal Service says it does not send texts or emails with links unless a customer has signed up for tracking updates with a specific tracking number.
Fake bank alerts ask whether you made a purchase. If you reply that you did not, you get a call from someone posing as the bank’s fraud department, who then talks you into moving money “to protect it.”
Other common versions include fake job offers that pay well for simple tasks, messages claiming to be from the IRS or Social Security Administration, prize and gift card offers, and “Hi Mom, I lost my phone, this is my new number” messages that ask a parent to send money urgently.
Three typical scam texts, decoded
The messages below are made-up examples, but they closely follow the patterns that show up in millions of real scam texts.
The first reads: “State Toll Services: You have an outstanding toll of $4.35. To avoid a late fee of $50, pay today at” followed by a link. The red flags are the vague sender name, the tiny amount designed to seem harmless, the threat of a much larger fee, and a link that does not end in .gov. A real toll agency would bill your existing account and would not threaten you by text.
The second says: “Your package is on hold due to an incomplete address. Update your details within 24 hours or it will be returned to sender.” It gives no tracking number, no retailer and no delivery company you recognize. The 24-hour deadline is there to rush you. Check your orders in the store’s app instead.
The third arrives from an unknown number: “Hi Jenny, it’s Mark from the conference, are you free for coffee next week?” If you reply that they have the wrong number, the sender apologizes, compliments you and keeps chatting. Days later, the talk turns to a cryptocurrency platform that has made them rich. This slow approach is one of the most costly scams in the country, because victims are often persuaded to invest again and again.
What real companies will never text you
Some requests should be treated as an automatic red flag, no matter how official the message looks. Legitimate banks, government agencies and delivery companies will not text you to:
- Ask for your full Social Security number, PIN or online banking password
- Ask you to read back or forward a verification code
- Demand payment in gift cards, cryptocurrency or wire transfers
- Threaten arrest, deportation or legal action unless you pay immediately
- Ask you to move money to a “safe account” to protect it
- Send a link to collect customs fees or postage on a package you did not order
If a text asks for any of these, you can be confident it is a scam. Keeping this short list in mind is often faster than analyzing the link or the sender in detail.
What to do when you get a scam text
If you suspect a message is a scam, the safest response is to do very little:
- Do not tap any links or call any numbers in the message.
- Do not reply, not even “STOP,” unless the message is from a company you know you signed up with.
- Forward the text to 7726, which spells SPAM on a keypad. This reports it to your wireless carrier at no cost.
- Report it to the FTC at ReportFraud.ftc.gov.
- Block the number and delete the message.
If you are unsure whether a message is real, contact the company directly using a phone number or website you already trust, such as the number on the back of your bank card or the app you normally use. Never use the contact details in the suspicious text.
What to do if you already clicked or replied
Tapping a link does not always mean harm, especially if you did not enter any information. But act quickly if you did share anything.
If you entered a password, change it right away on the real website, along with any other accounts that use the same password. Turn on two-factor authentication where you can.
If you shared card or bank details, call your bank or card company using the number on your card. Ask them to block the card and watch for fraudulent charges. Report any unauthorized transactions as soon as possible, because quick reporting often improves your chances of getting money back.
If you shared your Social Security number, consider freezing your credit with all three major credit bureaus, Equifax, Experian and TransUnion. A credit freeze is free and stops anyone from opening new credit in your name. The FTC’s IdentityTheft.gov walks you through a recovery plan step by step.
If you sent money, contact the payment provider immediately. Wire transfers, gift cards and cryptocurrency are hard to recover, but acting within hours sometimes helps. Report the loss to the FTC and to the FBI’s Internet Crime Complaint Center.
How to cut down on scam texts
You cannot stop every scam text, but you can reduce how many reach you.
On an iPhone, turn on the option to filter unknown senders in the Messages settings, which moves texts from people who are not in your contacts into a separate list. On Android phones using Google Messages, make sure spam protection is switched on. Most major carriers also offer free spam and scam-blocking tools, such as Verizon’s Call Filter, T-Mobile’s Scam Shield and AT&T’s ActiveArmor.
Be careful about where you share your phone number. Contests, online forms and store loyalty programs can all lead to your number being sold or leaked. Using a separate number, such as a free internet calling number, for sign-ups can help keep your main number cleaner.
Keep your phone’s software up to date. Updates often include security fixes and improved spam detection.
Protecting older parents and relatives
Older adults are frequent targets, and they often lose more money per scam when they are caught. Sometimes that is because they have more savings, and sometimes because scammers deliberately target people who are less familiar with how technology works.
A short conversation can make a big difference. Go through the warning signs together, and agree on a simple rule: never send money or share codes because of a text or call, without first checking with a family member. Some families set up a code word to confirm that a request for money really comes from a relative, which also helps against voice-cloning scams that use AI to imitate a loved one’s voice.
Help older relatives turn on spam filtering, save important numbers such as their bank and pharmacy in their contacts, and set up alerts on their bank accounts so unusual activity is spotted quickly.
Why stronger logins help
Many scam texts are really about stealing passwords. That is why switching important accounts to passkeys or strong two-factor authentication is one of the best long-term defenses.
Passkeys, which let you sign in with your fingerprint or face instead of a password, cannot be typed into a fake website, so a phishing link cannot steal them. Our guide to what passkeys are explains how to set them up for your email and other key accounts.
Authenticator apps are safer than text-message codes, because they cannot be intercepted by a SIM swap. Wherever you can, move your most important accounts, especially email and banking, to the strongest option they offer.
Scam texts at work
Businesses are targets too. A common version is a text that appears to come from the boss or company owner, asking an employee to buy gift cards for a client or to handle an urgent payment quietly. Another asks staff to log in to a fake version of the company’s email or payroll system.
Small businesses can protect themselves with simple rules: no payment or gift card purchase based on a text alone, a quick phone call to confirm any unusual request, and two-factor authentication on email and payroll systems. A five-minute conversation with staff about these rules can prevent a very expensive mistake.
Scam texts can come in other languages too
Scammers do not only write in English. Many campaigns target Spanish-speaking households, Chinese and Korean communities, and recent immigrants who may be less familiar with how American agencies and companies normally contact people. Some messages pretend to come from immigration offices or consulates and threaten legal trouble unless a fee is paid.
The warning signs are the same in every language: urgency, a link or number to contact, and a request for money or personal information. The FTC publishes scam warnings in several languages, and it is worth sharing them with family members who read another language more comfortably than English.
How to spot a scam text: common questions
Is it safe to open a scam text?
Reading a text is generally safe. The risk comes from tapping links, replying or calling numbers in the message.
Should I reply STOP to a spam text?
Not if you do not recognize the sender. Replying confirms your number is active. Forward it to 7726 and block the number instead.
Does the post office send texts about packages?
USPS says it only sends text updates if you signed up for them with a tracking number, and those messages do not ask for payment or personal information.
How do I report a scam text?
Forward it to 7726 and report it to the FTC at ReportFraud.ftc.gov. If you lost money, also report it to the FBI’s Internet Crime Complaint Center.
What should I do if I clicked a scam link?
If you entered information, change affected passwords, contact your bank, turn on two-factor authentication and consider a free credit freeze.
Can a scam text hack my phone just by opening it?
In most cases, no. Simply receiving or reading a scam text does not infect a modern, updated phone. The danger comes from what happens next: tapping a link that leads to a fake login page, installing an app the message pushes you toward, or replying with personal details. Rare, highly targeted spyware attacks have exploited phone flaws without any tap, but those are aimed at journalists, officials and activists, not ordinary users. Keeping your phone updated closes most of those holes. If a scam text worries you, report it to 7726, delete it and move on.
The next time a message makes your heart race, put the phone down for a minute and check the source yourself. For more technology guides, see our technology section and latest stories.
