How to Tell if a Text Message is a Scam: 10 Warning Signs

Scam text messages — called smishing (SMS + phishing) — surpassed email phishing in click-through rates in 2025. People are trained to be suspicious of emails, but texts feel more personal and urgent. The average person reads a text within 3 minutes of receiving it, and the short format makes it harder to spot red flags. Here are 10 warning signs that a text is a scam.

1. It's From a Random or Suspicious Number

Legitimate companies that send texts typically use short codes (5-6 digit numbers) or branded sender IDs that show the company name. If you receive what claims to be a bank alert from a regular 10-digit phone number with a random area code, that's suspicious.

However, scammers can also spoof short codes and caller IDs, so this alone isn't definitive. Use it as one data point among others.

2. It Contains a Link You Didn't Expect

This is the biggest red flag. Scam texts almost always include a link — that's the whole point. Common link patterns in scam texts:

• Shortened URLs: bit.ly/3xK9zR2, tinyurl.com/abc123
• Lookalike domains: usps-redelivery.com, fedex-update.info
• Random domains: track-pkg-7291.xyz
• Misspelled brand names: amaz0n-delivery.com

Legitimate companies rarely send links in text messages for account actions. If your bank needs you to do something, they'll tell you to open their app or call the number on your card.

3. It Creates Urgency

Scam texts apply time pressure:

"Your package will be returned to sender if you don't schedule delivery within 2 hours"

"Your account will be suspended in 30 minutes unless you verify your identity"

"You have an outstanding toll of $6.75. Pay by end of day to avoid a $50 late fee"

Real companies give you reasonable timeframes. Nobody suspends your account in 30 minutes via text message.

4. You Didn't Initiate the Interaction

Did you sign up for text alerts from this company? Did you request a verification code? Did you order a package that's expecting delivery?

If the text arrives completely out of the blue — you didn't request it, you're not expecting it, and you don't have a relationship with the sender — treat it as suspicious. This is especially true for "delivery notification" texts when you don't have any pending orders.

5. It Asks for Personal Information

No legitimate company asks for passwords, Social Security numbers, credit card details, or bank account information via text message. If a text asks you to reply with or enter personal information, it's a scam.

Even seemingly minor requests can be dangerous. A text asking you to "confirm your address" might be fishing for information to complete an identity theft profile.

6. It Mentions Money You Weren't Expecting

Scam texts about money take two forms:

• Money owed: "You have an unpaid toll of $4.35" or "Your tax refund of $1,247 is pending — verify to receive it"
• Money coming to you: "You've been selected for a $500 gift card" or "Your stimulus payment is ready to claim"

Both versions lead to phishing pages. The "money owed" texts exploit fear; the "money coming" texts exploit greed. Either way, the link captures your financial information.

7. The Grammar and Formatting Are Off

While scam texts have gotten more polished, many still contain telltale signs:

• Unusual spacing or capitalization: "Your USPS Package could NOT be delivered"
• Missing articles: "Verify account now" instead of "Verify your account now"
• Mixed formatting: inconsistent use of punctuation
• Unusual characters: using special Unicode characters that look like regular letters

That said, some scam texts are grammatically perfect. Don't assume a well-written text is safe — check the other warning signs too.

8. It Claims to Be From a Delivery Service

Fake delivery notifications are the single most common type of scam text. Examples our team has documented:

"USPS: Your package is being held due to an incomplete address. Update here: [link]"

"FedEx: Delivery attempted. No one available. Reschedule: [link]"

"UPS: A package for you is delayed. Confirm delivery details: [link]"

"Your Amazon order has been delayed. Track your shipment: [link]"

How to verify: If you're expecting a package, go directly to the carrier's website or app and enter the tracking number from your original order confirmation. USPS, FedEx, and UPS all have official apps with reliable tracking. Never use a link from a text message.

9. It's a "Wrong Number" That Turns Into a Conversation

A newer smishing tactic starts innocently:

"Hey, are we still meeting for lunch on Thursday?"

You reply: "I think you have the wrong number."

They respond: "Oh, sorry about that! Since we're talking though — have you heard about this investment opportunity?"

This is the "pig butchering" opening. The scammer builds rapport through a seemingly accidental contact, then gradually steers the conversation toward a fake investment platform, romance scam, or other fraud. The "wrong number" was always intentional.

What to do: Don't engage. Block the number.

10. It Asks You to Call a Number

Some scam texts don't include links — instead, they ask you to call a phone number:

"Bank of America fraud alert: A charge of $892.00 was made on your debit card. If you did not authorize this, call 1-833-XXX-XXXX immediately."

The number connects to a scam call center where someone posing as a bank representative asks for your account details, card number, PIN, or one-time verification codes.

How to verify: Call the number on the back of your bank card or on the bank's official website — never the number in the text message.

Real Scam Texts We've Analyzed

Here are actual scam texts submitted to our analysis tool (phone numbers redacted):

"EZPass: You have an unpaid toll of $6.99. To avoid a late fee of $50, pay now: ezpass-payment-center.com"

Analysis: EZPass doesn't send text messages for unpaid tolls — they send physical mail. The domain isn't affiliated with any state's EZPass system. The small dollar amount ($6.99) and large penalty ($50) are designed to make you think "it's not worth the risk, I'll just pay."

"Your SSA benefits have been suspended due to suspicious activity. Verify your identity at ssa-verify-portal.com or call 1-800-XXX-XXXX."

Analysis: The Social Security Administration doesn't communicate account issues via text message. The domain is not a .gov address. This scam targets older adults who depend on Social Security benefits.

Why Scam Texts Are Harder to Detect Than Scam Emails

Text messages present unique challenges compared to email phishing:

• No sender address to inspect. Emails show a full sender address that you can verify. Texts show a phone number (which can be spoofed) or a short code (which can be imitated). There's no domain to check.
• Limited formatting means fewer visual cues. In an email, you can spot mismatched branding, suspicious formatting, or low-quality logos. A text message is just text — there are fewer visual signals that something is off.
• Mobile browsers hide full URLs. When you tap a link on your phone, the mobile browser's address bar is small and often truncated, making it harder to verify you're on the correct website.
• Texts feel more personal. Email is associated with work, newsletters, and spam. Texts are associated with friends, family, and important alerts. This psychological framing makes people more trusting of text content.
• Texts create more urgency. The notification behavior of texts — vibrating your phone, appearing on your lock screen — creates a sense of immediacy that email doesn't match.

How to Protect Yourself from Smishing

Beyond recognizing individual scam texts, these habits reduce your overall risk:

1. Don't click links in texts from unknown numbers. This is the single most effective protection. If a text has a link and you didn't expect it, don't tap it.
2. Enable spam filtering on your phone. Both iPhone (Settings → Messages → Filter Unknown Senders) and Android (Google Messages has built-in spam detection) offer filtering that catches many scam texts before you see them.
3. Register with the Do Not Call Registry. While scammers ignore it, legitimate telemarketers are required to check it. This reduces the overall volume of unsolicited messages, making scam texts easier to identify.
4. Use your carrier's scam blocking tools. T-Mobile Scam Shield, AT&T ActiveArmor, and Verizon Call Filter all offer free scam text detection and blocking. Enable them through your carrier's app.
5. Be careful where you share your phone number. Every form you fill out, every account you create, every loyalty program you join — your number gets added to databases that may eventually be breached or sold. Use a secondary number (Google Voice, for example) for non-essential signups.
6. Keep your phone's software updated. OS updates patch security vulnerabilities that malicious websites can exploit through your browser. An up-to-date phone is significantly harder to compromise through a link click.

What If You Already Clicked a Link in a Scam Text?

If you tapped a link before realizing it was a scam:

1. Close the browser immediately. Swipe the browser app closed from your app switcher.
2. Don't enter any information. If you clicked but didn't type anything, your risk is lower.
3. Clear your browser data. Go to Settings → Safari (or Chrome) → Clear History and Website Data.
4. If you entered credentials, change that password immediately from a different device. Enable two-factor authentication on the affected account.
5. If you entered payment information, call your bank or credit card company immediately to report the compromise and request a new card.
6. Run a security scan. On Android, use Google Play Protect or a reputable antivirus app. On iPhone, ensure your iOS is up to date — iOS doesn't support antivirus apps, but its built-in security is strong when kept current.
7. Monitor your accounts for unusual activity over the next 30 days.

How to Handle Scam Texts

1. Don't click any links. Not even to "see where it goes." Some phishing sites exploit browser vulnerabilities on load.
2. Don't reply. Replying confirms your number is active. Even replying "STOP" to a scam text can result in more scam messages.
3. Block the number. On iPhone: tap the number → "Info" → "Block this Caller." On Android: tap the number → "Block."
4. Report it. Forward the text to 7726 (SPAM) — this reports it to your carrier. You can also report to the FTC at reportfraud.ftc.gov.
5. Delete the message after reporting.

If you've received a text you're not sure about, copy the text and paste it into IsThisAScam for instant analysis. The tool identifies smishing patterns, checks the claims being made, and tells you whether the message is safe — before you risk clicking anything.