How to Tell if a Text Message is a Scam
Scam texts work because they are short. There is no letterhead to examine and no tone of voice to judge, just a line of text and a link, read in three seconds while you are doing something else.
The good news is that almost all of them fail at least one of four checks. Once you know the checks, the decision takes about five seconds.
The four checks
1. Were you expecting it?
Almost every scam text is unsolicited. A delivery notice for a parcel you did not order, a toll charge for a road you did not drive, a fraud alert for a bank you do not use.
An unexpected message asking you to act is the single strongest signal. Legitimate organizations do contact you unprompted, but rarely with urgency and a link.
2. Does it create urgency?
Scam texts almost always impose a deadline: your account will be closed today, your package will be returned this afternoon, a fine doubles tomorrow, someone is accessing your account right now.
Urgency exists to stop you thinking. Real organizations give you time, and a genuine fraud alert asks you to confirm a transaction, not to log in immediately through a link.
3. Where does the link actually go?
This is the check that catches the most.
Look at the domain immediately before the first single slash. In secure-usps.delivery-track.info/xyz, the real domain is delivery-track.info, not USPS. Everything to the left is decoration.
Common tells:
- Unusual endings on a message claiming to be from a government agency or a major company
- Hyphenated imitations of a real brand
- URL shorteners, which hide the destination entirely
- Slight misspellings that read correctly at a glance
Do not tap to find out. If the message might be real, go to the organization directly: type the address yourself, or use the app you already have.
4. What is it asking for?
Look at what the message actually wants. A scam wants one of a small number of things: a payment, card or bank details, a login, a verification code, or personal data like your Social Security number or date of birth.
A verification code request is always a scam. No legitimate organization will ever ask you to read back a code they just sent you. That code is the last thing standing between a criminal and your account.
The messages circulating right now
Unpaid toll notices. Currently one of the most common. A text claims you owe a small toll and threatens a late fee. The amount is deliberately small enough to pay without thinking. Tolling authorities do not collect by text link, and if you genuinely have an unpaid toll, your account with the tolling agency will show it.
Failed delivery notices. A parcel could not be delivered and needs an address confirmation or a small redelivery fee. Carriers do not charge redelivery fees by text. Track the parcel using the number from your original order confirmation.
Bank fraud alerts. "Did you authorize a $[amount] transaction? Reply NO." Replying starts a conversation with a criminal, who then calls posing as the fraud team and asks for a code. Real fraud alerts can be answered inside your banking app. Call the number on the back of your card, never a number in the message.
Government impersonation. Messages claiming to be from the IRS, the Social Security Administration, or a state motor vehicle agency, about a refund, a suspended number, or a fine. Federal agencies do not initiate contact by text and do not demand payment that way.
"Wrong number" openers. A friendly message clearly meant for someone else. The goal is a conversation, which builds over days or weeks into a fake investment or crypto opportunity. These are patient and can run for months.
Job offers. Well-paid remote work by text, often "product reviewing" or "task-based" work. The pattern ends with you depositing your own money to unlock commissions.
Protect Your Money With Our Free Newsletter
What to do with a scam text
Do not reply. Not even "STOP". A reply confirms the number is live and in use, which makes it more valuable and gets you more messages.
Do not tap the link.
Report it. Forward the message to 7726 (SPAM), which is free on all major US carriers and feeds carrier-level blocking. You can also report to the FTC at reportfraud.ftc.gov.
Block and delete. Scammers rotate numbers constantly so blocking is imperfect, but it costs nothing.
If you already tapped the link
Do not panic. Tapping a link is usually not enough on its own to cause harm. What matters is what happened next.
If you only opened the page and closed it, you are very likely fine. Close the tab and move on.
If you entered a password, change it immediately on that account, and anywhere else you used the same password. Turn on two-factor authentication. This is the highest-priority action.
If you entered card details, call your card issuer using the number on the back of the card, report the details compromised, and ask for a replacement. Then watch for unfamiliar charges.
If you entered bank login details, call your bank immediately using the number on your card or statement. Ask them to secure the account and change your online banking credentials.
If you shared a verification code, act fast. Whoever has it is probably in the account now. Change the password, sign out all sessions, and contact the provider.
If you downloaded a file or installed an app, remove it, run a security scan, and change passwords from a different device.
If you sent money, that is a different situation with different deadlines. See what to do if you paid a scammer.
Two habits that prevent most of this
Never use contact details from the message itself. Not the link, not the phone number, not the email address. If something might be real, reach the organization your own way: the app on your phone, the number on the back of your card, a bookmark you already had.
Slow down on anything urgent. Nearly every one of these attacks depends on you acting inside a few seconds. A pause of even a minute defeats most of them.
Why scam texts are worth taking seriously
Scam texts are not a fringe problem. Consumers reported losing about $16 billion to fraud in 2025, the highest figure on record and roughly 25% up on the year before, and imposter scams — the category most of these texts belong to — accounted for around $3.5 billion of it. Nearly one in three fraud reports involved an imposter.
Those numbers only cover reports that were actually made, and most fraud is never reported at all. We break down where those figures come from, and why they understate the problem, in how much money Americans lose to scams each year.
What Chimo does
Chimo helps with the money side of consumer harm: refunds, unauthorized charges, and class action settlements against companies whose conduct cost people money.
If your details were exposed in a company's data breach, that is frequently the subject of a settlement, and those settlements pay.
- Is it safe to reply STOP to a scam text?
- No. Replying anything, including STOP, confirms your number is active and monitored, which makes it more valuable to sell on and usually increases the volume you receive. Forward the message to 7726 and block the sender instead.
- What happens if I clicked a link in a scam text but did not enter anything?
- In most cases nothing. Simply loading a page rarely compromises a modern, updated phone, and the risk comes from what you type or download next. Close the page, and if you are unsure whether you entered anything, change the password for the account it imitated.
- How can I check where a text link really goes without tapping it?
- Read the domain immediately before the first single slash, since that is the real destination and everything to the left of it can be faked. If the link is shortened, you cannot tell at all, so go to the organization directly through its app or a web address you type yourself.
- Are unpaid toll texts real?
- Effectively never. Tolling authorities do not collect small unpaid tolls by text message with a payment link, and this has been one of the most widespread scam campaigns in the US. Check your account with the tolling agency directly if you think you might genuinely owe something.
- Why do scam texts ask me to confirm a code?
- Because that code is what lets them into your account. They have your password already, or are triggering a password reset, and the one-time code is the only remaining barrier. No legitimate organization ever asks you to read a code back to them.
- Should I report scam texts, and does it help?
- Yes. Forwarding to 7726 is free and feeds carrier-level filtering that blocks numbers for everyone, and reporting to the FTC contributes to the data that drives enforcement. Neither gets you a personal response, but both have effects beyond your own inbox.
Related reading
If money already left your account, move quickly: what to do if you paid a scammer is organized by payment method, because the deadlines differ. For charges you did not authorize on a card, see what to do if your card is charged without permission. For the wider pattern, read the most common impersonation scams.
