Fake text messages: how to spot a scam text, and what to do if you tapped the link

Updated 29 October 2026

Smishing is phishing by text message: a text that pretends to come from a delivery company, a toll agency, your bank, a tax office or a family member, and pushes you to tap a link, pay a small fee or share a code. To protect yourself, do not use the links or phone numbers in an unexpected text. Check with the organization through its official app, its website or a number you already know. If you already entered card details or paid, call your bank or card issuer first.

A text sits among messages from people you know, so it is easy to act on before you think. As the Federal Trade Commission puts it, real companies will not ask for your account details by text.

The common scripts

• Unpaid tolls. You supposedly owe a few dollars in tolls. The FBI quoted one such text: an outstanding toll of $12.51, a late fee if unpaid, and a link made to look like the state's toll service. In 2025, New York warned E-ZPass customers that E-ZPass will never text to ask for card numbers or other sensitive details.
• Parcels and redelivery fees. A link leads to a fake USPS site that asks for a redelivery fee, as the FTC warned in 2025. The fee is small on purpose: the goal is your card details.
• Your bank. A fraud alert about a purchase you did not make, with a link or a number to call. The number reaches the scammers, who ask for your codes or tell you to move your money to keep it safe.
• Tax refunds. Money is waiting, if you claim it through the link. HMRC says it never announces a tax rebate by text, and the Canada Revenue Agency says it does not send refunds by text.
• Hi Mum and Hi Dad. An unknown number claims to be your child with a lost or broken phone, then asks for money for an urgent bill. Australia's consumer regulator reported a sharp rise in these messages in 2022, by text and on WhatsApp.

The same stories also arrive on paper, as a QR code on a letter or a parking notice. Our guide to fake QR codes covers that side.

Warning signs

One sign alone does not prove a scam, but each is a reason to stop and check.

• You did not expect it, and it comes from an unknown or international number. A familiar sender name is not proof: names can be faked.
• The link is shortened, so you cannot see where it goes, or its domain is close to the real one but not the same.
• It asks for a small payment to release a parcel or avoid a fee.
• It pushes you to act now: a growing fine, a closing account, a returned parcel.
• It asks for a verification code. Codes are for you to type into the company's own app or site, never to pass on.
• It asks you to install an app. Get apps only from your phone's official app store.
• It asks you to reply, even with just Y, or to continue the conversation in another app.

How to check a text before you tap

Without any app

1. Do not tap the link, and do not call a number from the text.
2. Read the domain in the link. It is the name that ends just before the first single slash, and what counts is the end of that name: usually its last two parts, or three in endings such as .co.uk. In https://usps.com.redelivery-fee.example/track, the site is redelivery-fee.example, not the Postal Service: anyone can put familiar words in front.
3. A shortened link hides the domain completely. Treat it as unknown, not as safe.
4. Go to the organization yourself: its app, the website you know, or the number on your card or bill. A real notice will be there too.
5. If a family member writes from a new number, call their old number before you send any money.

For more on reading web addresses, look-alike domains and free link checkers, see our guide on how to check if a link is safe.

With a link-checking app

Our Android app LinkShield is coming soon to Google Play. Share or paste a link into it, and it checks the link's structure for signs of risk and matches it against built-in lists of known phishing and malware sites, both on your phone. It also asks the Quad9 encrypted DNS service, and for Pro users Google Web Risk through a server we run that does not store the address. It does not read your messages: you choose which link to check.

No checker catches everything. A scam site set up an hour ago may not be on any list yet, so a clean result means only that no known threat matched at the time. When a text asks for money, the habits above still come first.

If you already tapped the link

Opening a page is usually not harmful by itself; what matters is what you did next. If you typed details, paid, shared a code or installed something, act quickly, in this order:

1. Card or bank details, or a payment: call your card issuer or bank on the number on the back of your card or in its official app. Ask them to block the card and dispute the payment.
2. A verification code: someone may be signing in to that account right now. Sign in through the official app, change the password and sign out other devices, or contact the company if you are locked out.
3. A password: change it on the real site and wherever you reused it, and turn on two-step verification for your email, bank and messaging apps.
4. An app you installed: uninstall it, and check your phone's settings for apps you do not recognize or that have accessibility access you did not mean to give.
5. Watch your statements for unknown charges over the next few months.
6. Report it, which helps stop the same text from catching others.

Where to report a scam text

• United States: forward the text to 7726 (SPAM) or use your messaging app's report option, and report it to the FTC at ReportFraud.ftc.gov. The FBI's Internet Crime Complaint Center at ic3.gov asks for the sending number and the website in the text. If someone is using your personal details, go to IdentityTheft.gov.
• United Kingdom: forward the text to 7726, which is free with most providers. Texts pretending to be from HMRC can also go to 60599. If you lost money, report to Report Fraud or call 0300 123 2040 in England, Wales and Northern Ireland, or call Police Scotland on 101.
• Canada: forward the text to 7726, as Get Cyber Safe advises, and report it to the Canadian Anti-Fraud Centre, online or at 1-888-495-8501.
• Australia: report it to Scamwatch. Telstra customers can also forward it to 7226. If you lost money, contact your bank first, then the police through ReportCyber.
• Elsewhere: contact your national police or fraud reporting service.

Questions and answers

Can opening a scam text hack my phone?

Reading a text is very unlikely to harm your phone on its own. The risk starts when you tap the link and then type details, pay or install something. The rare flaws used against high-profile targets are fixed by system updates, so install them promptly.

I only tapped the link and did not type anything. Am I safe?

Most likely, yes. Close the page and delete the text. If the page downloaded a file, delete it without opening it, and check that no new app was installed.

How did scammers get my number?

Usually nobody picked you: scam texts go out in bulk to long lists of numbers, some of them from data leaks, which is why a text may even include your name. A reply confirms that the number is in use, so do not answer.

Should I reply STOP?

Not to a scam text. The Federal Communications Commission advises not to respond to suspicious texts, even when they say to text STOP. STOP is for messages from a business you signed up with. For anything else, report the text and delete it.

The text appeared in the same thread as real messages from that company. Is it genuine?

Not necessarily. Sender names can be faked, so a scam text can land next to genuine ones. Judge the message by what it asks you to do, and check through the official app or website.