Ping. “USPS: your package has an unpaid shipping fee. Update your address here to avoid return.” You are expecting a package. Your thumb is already moving toward the link before your brain has weighed in.
Scam texts, sometimes called smishing, work precisely because texts feel personal and urgent. We read ninety-eight percent of them, usually within a few minutes. That trust is exactly what a scammer is renting when they slide a fake message into the same thread as your real ones.
Key takeaways
- Delivery, bank, and prize texts are the three most common scam templates, and they all push you to tap a link fast.
- A shortened or odd-looking link in a text is a major red flag; real companies use their own clear web addresses.
- Never reply, never tap, and never call the number in a suspicious text; verify through the official app instead.
- Forwarding scam texts to 7726 (SPAM) helps your carrier block the sender for everyone.
Why texts are the scammer’s favorite tool
A text arrives with almost no defenses in front of it. There is no spam folder catching most of them, no sender logo to inspect, and very little room for the careful clues you would find in an email. It is just a short, believable line and a link.
Phone numbers are also cheap and disposable. Scammers spin up thousands, blast messages, and abandon the numbers before anyone catches up. The low cost and high open rate make texting a numbers game that pays off even if only a fraction of people respond.
Because a text is so stripped down, your defense has to be a habit rather than an inspection. You cannot always tell a fake by looking; you tell it by how it behaves.
The three scam texts you will see most
Almost every scam text is a variation on three themes. Recognize the pattern and the specific wording stops mattering.
The delivery problem
“Your package is held,” “a fee is due,” “confirm your address.” These spike around holidays when everyone is expecting deliveries. The link leads to a fake page that harvests your card or login. A real carrier does not text you demanding a fee through a random link.
The bank or account alert
“Did you make a 500 purchase? Reply NO to cancel.” Replying or tapping connects you to a scammer, not your bank. This one is scary by design, because money makes people react before they think.
The prize or refund
“You have won,” “claim your reward,” “your refund is ready.” Free money is the oldest bait there is. If you did not enter anything, you did not win anything.
“Wrong number” texts that turn friendly are a slower scam. A stranger texts as if they meant someone else, chats warmly for days, then eventually steers you toward a fake investment. If a stranger’s wrong number becomes a budding friendship, step away.
How to read a suspicious text in ten seconds
You can triage almost any text with a quick mental checklist. None of these require you to tap anything.
| Check | Safe sign | Scam sign |
|---|---|---|
| The link | Company’s real, readable domain | Shortened, misspelled, or random characters |
| The sender | A short code you recognize from that company | An unknown 10-digit number or email address |
| The ask | Informational, no action needed | Tap now, pay now, reply now |
| The context | Matches something you actually started | Out of the blue about an account or package |
When I set this up as a rule for my dad, I told him to look only at the link and the ask. If either one looks off, he deletes the text without a second thought. Two checks, ten seconds, done.
Do not reply “STOP” to a text you believe is a scam. With real marketing lists it unsubscribes you, but to a scammer it simply confirms your number is live and read by a human, which invites more messages. Just delete and report instead.
The safe way to respond
The correct response to a suspicious text is almost boringly simple: do not engage with the message at all. No tapping, no replying, no calling the number it gives you.
If the text might be real, for example an actual delivery you are tracking, go to the source yourself. Open the carrier’s official app or type its known website into your browser. Log into your bank directly rather than through any link. The real information, if it exists, lives in your account, not in that text.
This is the same verify-independently rule that runs through our whole primer on how to spot scams and phishing. Route around the message and the scam has nothing to hook.
On both iPhone and Android you can filter messages from unknown senders into a separate list so they never mix with your real threads. On iPhone it is under Settings, Messages, Filter Unknown Senders; on Android, open Messages settings and enable spam protection.
Report the text so it stops
Reporting scam texts is quick and genuinely useful. In the United States, forward the message to 7726, which spells SPAM on the keypad. Your carrier uses these reports to block numbers and warn others.
You can also report to the Federal Trade Commission at reportfraud.ftc.gov, which feeds law enforcement data on active scams. Both take under a minute and cost you nothing.
Texts and emails share the same DNA, so the skills carry over. If you want to sharpen the email side, our guide on how to spot a phishing email before you click covers the extra clues an inbox gives you. And if a scammer escalates from texting you to calling you, our piece on how to handle scam phone calls and vishing has the calm scripts to end it.
Your afternoon checklist
- Turn on unknown-sender filtering on your phone so scam texts land in a separate list.
- Memorize the two-check habit: look at the link and the ask, and delete if either is off.
- Save the 7726 (SPAM) forwarding number so reporting is one step next time.
- Add your bank and main delivery carriers’ official apps to your home screen for direct access.
- Tell family members never to tap links or reply to unexpected package or bank texts.
- Bookmark reportfraud.ftc.gov to report the scams that slip through.
- Turn on two-factor authentication for accounts a stolen text link could target.
Scam texts are relentless, but your defense does not have to be complicated. Treat every unexpected link as guilty until proven innocent, verify through the real app, and that late-night “package fee” becomes one more thing you delete before finishing your coffee.
