How to Check if a Text Message is Spam

Smishing — phishing via SMS — increased 318% between 2023 and 2025, according to Proofpoint's annual threat report. The Federal Communications Commission received over 400,000 complaints about unwanted text messages in 2025 alone. Scam texts impersonate banks, delivery services, government agencies, and tech companies, all aiming to get you to click a malicious link or call a fraudulent phone number.

Text messages feel more personal and urgent than email, which is exactly why scammers love them. This guide helps you identify and handle suspicious texts.

The 5 Most Common Smishing Patterns

1. Delivery Notification Scams

"Your package cannot be delivered. Update your address: [link]." These impersonate USPS, FedEx, UPS, and Amazon. The link leads to a phishing page that collects your personal and payment information. For a deep dive, see our guide on USPS scam texts.

2. Bank and Financial Alerts

"Chase: Suspicious activity detected on your account. Verify: [link]." Real banks may text you about suspicious activity, but they will never include a link to click. They will ask you to call the number on the back of your card or log into the official app.

3. Government Impersonation

"IRS: You are eligible for a $1,400 stimulus payment. Claim now: [link]." The IRS does not initiate contact by text message. Neither does the SSA, FBI, or any other federal agency.

4. Prize and Lottery Scams

"Congratulations! You've won a $500 Walmart gift card. Claim: [link]." You did not win. These texts collect personal information or charge a "processing fee" to claim a prize that does not exist.

5. Account Verification Scams

"Your Apple ID has been locked. Verify your identity: [link]." These target popular services where most people have accounts — Apple, Google, Netflix, Amazon — exploiting the likelihood that the recipient is actually a customer.

How to Identify a Scam Text

Check the Sender

• Unknown phone number: Legitimate businesses text from shortcodes (5-6 digit numbers) or verified sender IDs, not random 10-digit phone numbers.
• International number: If you have no international contacts, texts from foreign numbers are almost certainly spam.
• Alphanumeric sender: Some carriers display a sender name instead of a number. Verify it matches the company's known shortcode.

Examine the Link

• Does the domain match the company? USPS uses only usps.com. Your bank uses their official domain.
• Is it a shortened link (bit.ly, tinyurl)? Legitimate companies in automated messages rarely use link shorteners.
• Does the URL contain suspicious elements — IP addresses, random strings, or look-alike domains?

Evaluate the Message

• Urgency: "Act now," "immediate action required," "your account will be closed" — manufactured urgency is the hallmark of scam texts.
• Generic greeting: "Dear Customer" instead of your name.
• Grammar errors: While scammers are getting better, many texts still contain obvious errors.
• Too good to be true: Free prizes, government payments you didn't apply for, refunds you weren't expecting.

What to Do With a Suspicious Text

1. Do not click any links. This is the single most important rule.
2. Do not reply. Replying confirms your number is active, leading to more spam.
3. Forward to 7726 (SPAM). This works on AT&T, Verizon, T-Mobile, and most carriers. The carrier will investigate and potentially block the sender.
4. Report to the FTC: File at ReportFraud.ftc.gov.
5. Block the number: On iPhone: tap the number > Block this Caller. On Android: tap the message > Details > Block.
6. Check with IsThisAScam: Paste the message content for 6-layer analysis that checks the text against known smishing patterns and URL reputation databases.

Built-in Spam Protection

iPhone

Settings > Messages > enable "Filter Unknown Senders." This separates messages from people not in your contacts into a separate list. It does not block them but keeps them from triggering notifications.

Android

Google Messages includes built-in spam detection. Open Google Messages > Settings > Spam protection > enable. Samsung Messages also has built-in spam filtering.

Carrier-Level Protection

T-Mobile Scam Shield, AT&T ActiveArmor, and Verizon Call Filter all include SMS spam filtering in their free tiers.

If You Already Clicked a Link

1. Do not enter any information on the page that opens
2. Close the browser immediately
3. If you entered login credentials, change those passwords immediately on the official website
4. If you entered payment information, contact your bank for a new card and fraud alert
5. Run a security scan on your phone (Google Play Protect on Android)
6. Monitor your accounts for unauthorized activity for at least 90 days

For more, see checking phone numbers for scams and verifying callers.