Scam Text Messages: How to Spot and Stop Smishing

How to spot scam texts that no longer have typos: the five scripts behind most smishing, how to check a link without tapping it, what to do if you clicked, and how to filter them.

A scam text used to give itself away with a spelling mistake, a strange greeting, or a sender that was obviously a random number. The ones arriving now are fluent, short, and often correct about small details, such as the name of your bank or the fact that you ordered a parcel this week. The old advice to look for typos no longer protects anyone. This guide replaces it with checks that do not depend on the scammer making a mistake: what the common scripts look like, how to inspect a link without tapping it, what to do if you already did, and how to stop most of these messages from reaching you at all.

The scale is not small. Americans reported losing $470 million to scams that started with a text message in 2024, five times the figure for 2020, according to the Federal Trade Commission. The FTC notes that most fraud is never reported, so the real figure is higher. Texting is attractive to scammers for simple reasons: people read texts within minutes, a phone screen hides most of a link, and a message that looks like a delivery update blends into an ordinary day.

The 30-second answer

If a text asks you to tap a link, pay something, confirm details, or reply, handle it in this order:

1. Do not tap and do not reply. Not even with STOP or "wrong number". A reply confirms that the number is active and read by a person, which makes it more valuable to the sender.
2. Check through a channel you choose. Open the company's own app, or type its website address yourself, and look for the problem there. If the toll, parcel, or bank issue is real, it will be visible in your account.
3. Report it, then delete it. Forward the message to 7726 (SPAM) in the United States or the United Kingdom, use the "Report junk" option in your messaging app, and delete the conversation.

That is enough for most messages. The rest of this guide is for the ones that seem plausible, the ones you already acted on, and the goal of seeing fewer of them.

The five scam texts people actually receive

Most scam texts are variations on a handful of scripts. In its analysis of 2024 reports, the FTC found that five of them account for about half of all text frauds reported. Knowing the scripts matters more than knowing the senders, because the numbers change constantly while the stories stay the same.

1. The parcel that cannot be delivered

"Your package is on hold due to an incomplete address. Update your details within 24 hours." The link leads to a convincing copy of a postal or courier site that asks for your address and a small redelivery fee, which is really a way to collect your card number. This was the most reported text scam in 2024. The U.S. Postal Inspection Service states plainly that USPS will not text you without you first requesting updates with a tracking number, and that a genuine USPS tracking text will not contain a link. Other national postal services give similar warnings.

2. The job that pays for simple tasks

A recruiter offers remote work rating products, liking videos, or "optimizing apps" for good pay. Early tasks pay small amounts to build trust, then the platform requires you to deposit your own money, usually cryptocurrency, to unlock higher-paying task sets. The deposits never come back. Real employers do not recruit by unsolicited text, and no legitimate job asks you to pay in order to be paid.

3. The fraud alert that is itself the fraud

"Did you attempt a purchase of $849.99 at an electronics store? Reply YES or NO." Replying NO triggers a phone call from someone claiming to be your bank's fraud team, who then walks you through "securing" your account by moving money or reading back a one-time code. Your bank's real fraud team will never ask you to transfer money to protect it, and never needs a code the bank itself sent you. Hang up and call the number printed on your card.

4. The unpaid toll

"You have an outstanding toll balance of $12.51. Pay now to avoid a late fee." The FBI's Internet Crime Complaint Center warned about this campaign in April 2024 after receiving more than 2,000 complaints in its first weeks, and it has run in waves ever since, often reaching people in states where they have never driven on a toll road. The small amount is deliberate: it is low enough to pay without thinking, and the real prize is the card details. Check the toll agency's own website, reached by typing the address yourself.

5. The wrong number that turns into a friendship

"Hi, is this David? We met at the conference last week." When you politely reply that it is a wrong number, the sender apologizes, keeps chatting, and over days or weeks becomes a friend or romantic interest who happens to be very successful at investing. This is the opening of the investment frauds that take the largest sums, and it almost always ends at a fake trading platform. Our guide to trading bot scams explains how those platforms work and how to check one in ten minutes.

Other scripts worth recognizing

• The code sent "by mistake": "I just sent you a verification code by accident, can you forward it?" The code is for your own account. Someone is trying to sign in as you or to take over your messaging app.
• The family emergency: "Hi Mum, I broke my phone, this is my new number", followed within minutes by an urgent request for money. Call your family member on the number you already have.
• The suspended account: a streaming service, Apple ID, or bank account that will be closed unless you log in through the link today.
• The prize or refund: a tax refund, loyalty points about to expire, or a gift card you won in a draw you never entered.

Why scam texts are harder to spot than they used to be

Three changes explain why so many careful people now get caught.

The writing is fluent. Scammers use the same language models everyone else uses. Messages arrive in clean, idiomatic English, or in your own language if you live elsewhere, with the right tone for a delivery company or a bank. Poor grammar was never a reliable signal and is now almost useless.

The details are real. Your name, number, address, and the fact that you bank with a particular company are often available from old data breaches and data brokers. A message that uses your first name and mentions your real bank feels verified. It is not. If you want to see which breaches have exposed your details, our guide to checking Have I Been Pwned walks through it and covers the scams that are built on that data.

The infrastructure is disposable. Scam campaigns register new domains in bulk, use each for days, and send from rotating numbers, email-to-text gateways, and messaging accounts. Blocking a single sender barely slows a campaign down, which is why reporting and filtering matter more than blocking.

Red flags that still work

None of these proves a scam alone, but two or more in the same message should end the conversation:

• Urgency with a deadline: within 24 hours, today, or before a fee or suspension kicks in.
• A link where an app would be normal: banks, carriers, and toll agencies want you in their app or on their site, not on a link from a text you did not expect.
• A request to reply: YES/NO, a code, or "confirm your details". Replies are how scammers find the numbers worth following up.
• A small amount to pay: a redelivery fee or toll balance of a few dollars is designed to feel too minor to question.
• A payment method that cannot be reversed: gift cards, cryptocurrency, wire transfers, or payment apps sent to a stranger.
• A sender that does not match the brand: a ten-digit personal number or an email address claiming to be a national courier or a bank.
• A domain that is almost right: the brand name appears in the address, but not as the actual domain.

How to check a link without tapping it

Most scam texts show the full link in the message body, which is all you need. You do not have to open it to learn a lot about it.

Read the domain the right way

The part of an address that identifies the owner is the text directly before the first single slash, read from right to left. In usps.com-track-parcel.info/redelivery, the domain is com-track-parcel.info, not usps.com. In tolls.state-pay-online.top/pay, the owner is state-pay-online.top. Brand names placed at the start of an address, hyphenated into it, or followed by an unusual ending such as .top, .xyz, or .info are the most common disguise. A shortened link such as bit.ly hides the destination entirely, which in an unexpected text is a reason for caution by itself.

Check when the domain was registered

Real delivery companies, banks, and toll agencies have owned their domains for years. Scam domains are often days old. Paste the domain into a WHOIS / RDAP lookup and look at the creation date. A "toll payment" domain registered last week tells you everything you need to know. Owner details are usually hidden behind privacy services, which is normal for legitimate sites too, so the date is the useful field, not the name.

See where it is hosted

A hostname to IP lookup shows the server address behind the domain, and an ASN lookup shows which network runs it. A national postal service hosted on a cheap offshore virtual server, or on the same network as dozens of other freshly registered "delivery" domains, is not what it claims to be. An IP blacklist check adds one more signal: addresses that send or host abuse tend to be listed quickly.

You do not need to run these checks on every message. They are for the text that seems plausible enough that you are tempted to act on it. If the checks leave any doubt, fall back to the rule that always works: go to the company through its own app or a website address you type yourself.

If you already tapped, replied, or paid

Act on what you actually did. The right response depends on how far the scam got.

• You tapped the link but entered nothing: close the page. On an up-to-date phone, simply opening a phishing page rarely causes harm by itself; the damage comes from what you type into it. Install pending system updates, and do not return to the page.
• You entered card details: call your bank using the number on the back of the card, report the card as compromised, and ask for a replacement. Do not wait to see whether a charge appears.
• You entered a password: change it on the real site straight away, and anywhere else you used the same password. Turn on two-factor authentication and sign out other active sessions.
• You shared a verification code: treat it as an account takeover in progress. Change the password, check the account's recovery email and phone number, and contact the provider's support.
• You replied: nothing is lost, but expect more messages. Do not engage further, and report the next ones too.
• You paid by gift card, crypto, or wire: contact the card issuer, exchange, or bank immediately. Recovery is unlikely but not impossible if you move fast, and the report matters either way.
• Your phone suddenly shows no service: call your carrier from another phone. A leaked number plus personal details is the setup for a SIM swap, in which someone moves your number to their SIM to receive your codes.

Then expect the follow-up. People who responded once are marked as worth trying again, and a common second wave is the "recovery" offer from someone promising to get your money back for a fee. That is a second scam, usually by the same group.

How to report a scam text

Reporting takes less than a minute and is the main way carriers learn which senders to block. The FTC recommends three steps:

1. Forward the message to 7726. The digits spell SPAM on a phone keypad, and the major U.S. carriers use the reports to block similar messages. The code also works on UK networks. Your carrier may reply asking for the sender's number.
2. Use the report option in your messaging app. Both Apple Messages and Google Messages offer "Report junk" or "Report spam", which blocks the sender and feeds their filters.
3. File a report with the authorities. In the United States that is ReportFraud.ftc.gov, plus the FBI's IC3 if you lost money. In the United Kingdom it is Action Fraud, and in Australia, Scamwatch. Postal scams in the U.S. can also go to spam@uspis.gov.

Stop scam texts before they reach you

Recognizing a scam is a skill you have to apply every time. Filtering works whether you are paying attention or not, which is why it is worth setting up once. Start with the free options built into your phone.

iPhone

In iOS 26, open Messages, tap the filter icon in the top-right corner, choose Manage Filtering, and turn on Screen Unknown Senders. Messages from numbers you have never interacted with move into a separate Unknown Senders area, likely spam goes to a Spam folder, and neither triggers a notification. You can still allow alerts for categories you want, such as time-sensitive codes or transaction updates. On older versions, the equivalent switch is Filter Unknown Senders in the Messages settings.

Android

Google Messages includes spam protection and, in supported regions, scam detection that analyzes conversations with non-contacts on the device and warns you when a message matches known scam patterns, such as fake toll fees, package problems, or investment pitches. It is on by default where available and can be managed under Spam protection in the app's settings. Phones that use a manufacturer's own messaging app have similar options under their spam settings.

Dedicated scam text filters

Third-party filters add another layer, usually by combining message analysis with other protection. On iPhone they work through Apple's message filtering system, which only hands them texts from senders who are not in your contacts, so conversations with people you know stay private.

Surfshark added scam text protection in August 2026 as part of its Surfshark One plans. According to Surfshark, it checks incoming texts for suspicious links, sender numbers, and message content. On iPhone, detected scams move to the Spam folder in Messages without a notification. On Android, you get a Surfshark warning and can inspect the message inside the app, away from live links. Surfshark says the feature does not keep your messages or use them to train AI models.

Whatever you use, no filter catches everything. A message that gets through is not proof that it is genuine. Filters reduce the number of decisions you have to make; the checks above cover the ones that remain.

Scam texts versus scam calls and emails

The same groups usually run all three channels, and the scripts move between them. A text about a suspicious purchase is often followed by a call from the "fraud department". An email about a locked account may be followed by a text with a "verification" link. If an unknown number keeps contacting you, a reverse phone lookup can show whether it is a VoIP line and what others have reported about it. For suspicious emails, our email header analyzer shows the real sending server and whether the message passed SPF, DKIM, and DMARC checks, which exposes most spoofed senders. The wider picture of how stolen details are gathered and used is covered in how hackers steal data.

Frequently asked questions

Can my phone be hacked just by opening a scam text?

Reading a message is very unlikely to harm an up-to-date phone. The risk comes from tapping the link and entering information, or from installing something the page asks you to install. Keep your phone updated so the rare attacks that target the messaging app itself are patched.

Should I reply STOP to a scam text?

No. STOP is meant for legitimate marketing messages from companies you have dealt with. Replying to a scam confirms that your number is active and read by a person. Report and delete it instead.

How did scammers get my number?

Usually from data breaches, data brokers, and public sources, and sometimes by generating numbers in sequence and texting all of them. Receiving a scam text does not mean your phone was compromised. It means your number is on a list, which is true of almost everyone.

Why do some scam texts come from an email address?

Messages can be sent to phones from email accounts through carrier gateways and through messaging services such as iMessage. Scammers use this because email accounts are cheap to create in bulk and harder to trace than phone numbers. A bank or courier will not text you from a personal email address.

Does USPS send text messages about deliveries?

Only if you asked for them by registering a tracking number, and even then the U.S. Postal Inspection Service says those messages will not contain a link. An unexpected USPS text with a link is a scam.

Is blocking the number enough?

Blocking helps a little, but scam campaigns rotate numbers constantly. Reporting to 7726 and through your messaging app does more, because it helps block the next numbers as well.

Do scam text filters read my messages?

They have to analyze messages to classify them. Built-in filters on iPhone and Google Messages do this on the device. On iPhone, third-party filters only receive texts from senders who are not in your contacts. Check each provider's privacy statement for what is retained.

Did this article help?

IP Trackers is free with no sign-up. A small contribution helps keep the guides current and the tools running.

Support IP Trackers

By Tudor Uzun

Founder and Senior Software Engineer, IP Trackers

Published September 25, 2026Editorial standards