How to Tell If a Text Message Is a Scam

A text says your package is delayed and needs a small fee. An email says there’s a problem with your bank account. A caller claims to be from a government office and says you must act now.

Any of these could be real, but they’re also common scam setups. The safest response is not to decide in a rush. Pause, don’t use the message’s links or contact details, verify the claim another way, and report it if it’s suspicious.

Here are nine practical signs that can help you tell if a text message is a scam. Most also apply to suspicious emails and phone calls.

1. The message arrives unexpectedly

An unexpected message is not automatically a scam. Your bank, a store, a doctor’s office, or a delivery company may contact you by text, email, or phone in some situations.

Still, surprise is a reason to slow down—especially when the message claims there’s an account problem, a missed delivery, a payment due, or an urgent security issue you didn’t know about.

Scammers count on you thinking, “I should fix this quickly,” before you have time to ask whether the situation makes sense.

What to do instead: Think about your recent activity. Did you actually place an order? Do you have an account with that business? Were you expecting a bill, refund, or call? If you’re unsure, go to the organization’s official website or app yourself rather than following the message.

2. It creates urgency, fear, or pressure to act immediately

“Your account will be locked today.” “Pay now to avoid arrest.” “Your package will be returned in one hour.” “Don’t tell anyone.” These are pressure tactics and major warning signs.

A scammer wants to keep you from taking the step that could expose the fraud: checking independently. Fear, deadlines, threats, and excitement about a prize can all make people more likely to act before thinking.

Legitimate organizations can have deadlines, of course. But a real issue can usually be checked through your normal account, a statement, an official app, or a trusted customer-service number.

What to do instead: Give yourself a pause. Close the message and verify through a separate route. A genuine account problem will still be there after you take a few minutes to check.

3. It asks you to click, scan, download, or call a number in the message

This is one of the clearest signs of a possible scam. A text may include a link. An email may contain a button or attachment. A printed-looking notice or email may ask you to scan a QR code. A voicemail may tell you to call a number right away.

Those details can lead to a fake sign-in page, a payment request, a malware download, or a convincing scam call. A QR code is simply another way to send you to a website, so it deserves the same caution as a suspicious link.

Reading an unexpected text or viewing an email preview is generally different from interacting with its contents. The bigger risks begin when you click, scan, open an attachment, download something, reply, call back, or enter information. Keeping your phone, browser, and apps updated is a sensible extra layer of protection, but it will not make a suspicious message trustworthy.

What to do instead: Don’t use the link, QR code, attachment, or phone number provided. Type the known website into your browser, open the organization’s official app, or use a number from the back of your card, a statement, or the company’s verified website.

4. It asks for a password, payment details, or a one-time code

A request for sensitive information should stop you in your tracks. This includes:

Passwords or account recovery answers
Debit or credit card numbers, bank account details, or payment app transfers
Social Security numbers or other identity information
PINs and security codes
One-time verification codes sent to your phone or email

That last item catches many people off guard. A one-time code may look harmless because it expires quickly. But if someone asks for it, they may be trying to sign in to your account or reset your password while pretending to be you.

What to do instead: Never share a verification code you didn’t request or don’t fully understand. If someone claiming to be from a bank or company asks for it, end the conversation and contact the organization independently.

5. The greeting or details don’t quite match

Generic greetings such as “Dear customer” can be suspicious, but they are not proof. The more useful clue is whether the details fit your real situation.

Maybe the text names a delivery company you didn’t use. Perhaps an email claims to be from your bank but refers to the wrong account. A caller may know your name but get basic details wrong. The message may use an old address, mention a business you no longer use, or give a vague description of an alleged problem.

Watch for awkward wording and strange spelling, but don’t rely on those alone. Scam messages can be polished, and legitimate messages sometimes contain mistakes.

What to do instead: Look for mismatches, not just typos. Then check the account or order through your usual method. A familiar logo and professional-looking language do not make a message genuine.

6. It offers an unexpected prize, refund, job, investment, or financial opportunity

Scams often begin with good news: an unclaimed refund, a contest prize, a work-from-home job, a guaranteed investment return, or a surprise payment. The catch usually appears later—a fee, a request for personal information, a check to deposit, or instructions to send money elsewhere.

A message that says you must pay money to receive money deserves particular skepticism. So does an offer that seems unusually generous but provides few clear details.

What to do instead: Don’t pay a fee or provide financial information to claim an unexpected reward. Search for the company or program on your own, and use its official contact information if you want to ask whether the offer is real.

7. The sender looks familiar—but that alone proves nothing

A familiar-looking phone number, sender name, email display name, or caller ID can be spoofed. Spoofing means a scammer makes the information shown on your screen look as if it came from someone else.

That’s why a local area code doesn’t prove a caller is nearby, and a message labeled with a company name doesn’t prove the company sent it. Email display names can be misleading too. The actual email address may be different from what appears at first glance.

This is also why “it came from my friend’s number” is not enough. A friend’s account may have been compromised, or a scammer may be impersonating them. If a message asks for money, gift cards, codes, or secrecy, contact your friend through a known number or another method before doing anything.

What to do instead: Treat the displayed identity as a clue, not confirmation. Verify independently using contact details you already trust.

8. The request doesn’t match the organization’s normal process

A supposed bank representative asking you to move money to a “safe” account is a red flag. So is a government caller demanding gift cards, cryptocurrency, or payment through a link sent by text.

Scammers often invent unusual procedures because they need you to bypass normal safeguards. They may ask you to install an app so they can “help,” move the conversation to a private messaging app, buy gift cards, send cash, or keep the matter secret.

Be especially careful with an unsolicited call that asks to access your computer or phone remotely. Do not install software or share a screen just because an unexpected caller says there is a virus, refund, account issue, or technical problem.

What to do instead: End the call or conversation. Find the organization’s official support page yourself and ask whether the request is legitimate. The FCC also advises consumers to be wary of suspicious texts and to verify messages through independently found contact information.

9. You cannot verify it without using the message

This is the most useful test when a message might possibly be legitimate: can you confirm the claim without using anything inside the message?

If the answer is yes, do that. Open your bank’s app from your phone’s home screen. Type a retailer’s web address yourself. Sign in through your saved bookmark. Call the number printed on your card or statement. For a delivery, check the order confirmation you already received.

A scammer can control the link, QR code, phone number, reply address, and instructions in the message. They do not control the trusted route you choose on your own.

A quick decision rule: Pause. Don’t click or reply. Verify independently. Report and block if it’s a scam.

What to do if you already clicked, replied, or shared information

First, don’t be embarrassed. These messages are designed to look believable and catch people when they’re busy or worried. Acting promptly is more useful than blaming yourself.

If you clicked a link but entered nothing: Close the page. Don’t download anything it offers. Install available security updates, and watch the related account for unfamiliar activity.
If you entered a password: Change it right away through the real website or app. If you used it anywhere else, change those accounts too. Turn on multifactor authentication where available.
If you shared a one-time code: Change the relevant account password and contact the company through an official channel.
If you shared card or bank information: Contact your bank or card issuer promptly using a trusted number. Ask what protective steps they recommend and review recent transactions.
If you sent money: Contact the payment company or financial institution immediately. Recovery is not always possible, but reporting quickly gives you the best chance to stop or trace a transaction.
If you shared identity information: Visit IdentityTheft.gov for U.S. government guidance on creating a recovery plan.

If someone threatens immediate harm, extortion, or an emergency involving you or a loved one, contact local law enforcement or emergency services as appropriate. Don’t rely on the threatening message for instructions.

How to report and block a suspicious message

In the United States, you can forward many unwanted or suspicious text messages to 7726, which spells SPAM. Your wireless provider may use that report to help investigate or filter unwanted messages. The FTC also accepts fraud reports at ReportFraud.ftc.gov.

For a suspicious email, use the “report phishing” or “report spam” option in your email service when available. For texts and calls, use your phone’s built-in block and report tools. Menu names and steps vary by phone model, carrier, messaging app, and software version, so look for options such as “Block,” “Report junk,” “Report spam,” or “Report phishing.”

Reporting is worthwhile even if you didn’t lose money. It can help providers and agencies spot patterns and may protect the next person who receives the same message.

Keep exploring

Smart speakers and phone assistants can be useful, but account privacy matters. Our guide to voice assistants for seniors explains the practical privacy and setup details worth checking before you bring one home.

For another simple way to make a home easier to manage without adding unnecessary complexity, see simple smart home devices for a more comfortable, confident home.

The bottom line

The best way to tell if a text message is a scam is to focus less on how convincing it looks and more on what it asks you to do. Unexpected pressure, links, QR codes, sensitive-information requests, unusual payment methods, and instructions to act in secret all deserve a pause.

When in doubt, leave the message alone and verify through a contact method you find yourself. That one habit can prevent a surprising number of costly mistakes.

9 Signs an Unexpected Text, Email, or Call Is a Scam