How to Tell if a Text Is a Scam: A Plain-Language Check

Written by cybersecurity professionals.

The direct answer

A text is probably a scam if it arrives unexpectedly, pushes you to act fast, and asks you to tap a link, call a number, pay, or share a code. The safest move is to not reply or tap anything, and to check the claim yourself by opening the company’s official app or website, or by calling the number printed on your card or bill.

You do not have to prove a text is fake. You only have to avoid using the contact details inside it.

Seven signs a text is a scam

1. You were not expecting it. A delivery notice when you ordered nothing, a toll bill when you did not drive a toll road, or a prize you never entered for.
2. It creates urgency. “Final notice.” “Your account will be suspended today.” “Pay within 24 hours to avoid a fee.” Pressure is there to stop you from thinking.
3. It asks you to tap a link. Real companies do send links, but a scam relies on one. Look closely: misspelled brand names, extra words, or unusual endings in the address are warning signs. Shortened links hide where they go.
4. It asks for a code. A one-time passcode sent to your phone is meant for you alone. Anyone who asks you to read it back, even someone claiming to be your bank, is trying to get into your account.
5. It asks for unusual payment. Gift cards, wire transfers, cryptocurrency, or payment apps sent to a person you do not know.
6. It starts as a “wrong number.” A friendly message meant for someone else can be the opening of a longer scam that builds trust over days or weeks before asking for money or an investment.
7. It comes from an odd sender. An email address in place of a phone number, a long or international number, or a number that does not match the company it claims to be.

One sign alone does not prove a scam. Two or more together should make you stop.

Common scam texts people search for

• Unpaid toll or traffic violation. Claims you owe a small amount and links to a payment page. Check by going to your toll agency’s or state’s official website yourself, not through the link.
• DMV or license notices. Same pattern. Your state motor vehicle agency’s website is the place to check.
• Package delivery problems. “We could not deliver your package, update your address.” Check tracking in the carrier’s own app or on the retailer’s order page.
• Bank or card alerts. “Did you make this purchase? Reply YES or NO.” Open your banking app or call the number on the back of your card.
• Job offers. Easy money for simple tasks, often asking you to pay upfront or move to another messaging app.

How to check a suspicious text safely: Stop, Check, Verify

This is the three-step method taught in the Personal Cybersecurity Essentials course.

Stop. Do not tap the link, call the number, or reply, not even “STOP.” Take a breath. Scams depend on speed.

Check. Ask three questions. Was I expecting this? Is it pushing me to act fast or pay in an unusual way? Does the sender or link actually match the company it claims to be?

Verify. Contact the company through a channel you already trust: its official app, a website address you type yourself, or the phone number on your card, bill, or account statement. If the problem is real, it will show up there.

If you want a second opinion, paste the message into the free Sword & Shield Scam Checker after removing any personal information. The Scam Checker requires a free account.

What to do if you already tapped the link

Act in this order:

1. If you entered a password, change it right away from the official app or website, and change it anywhere else you used the same password. Turn on multi-factor authentication.
2. If you entered card or bank details, call your bank or card issuer using the number on the back of your card and tell them what happened.
3. If you shared a one-time code, contact that company immediately. The code may have let someone sign in or approve a change.
4. If you downloaded something, do not open it. Update your phone’s operating system and remove apps you do not recognize.
5. Watch your accounts for the next few weeks for sign-in alerts, password reset emails, or charges you did not make.

If you only opened the text and did not tap or reply, you are generally fine. Delete it and report it.

How to report a scam text

In the United States:

• Forward the text to 7726 (which spells SPAM). This reports it to your mobile carrier.
• Report it to the Federal Trade Commission at ReportFraud.ftc.gov.
• Use your phone’s built-in “Report junk” or “Report spam” option, then block the number.

Build the habit, not just the checklist

Scam texts change their story constantly: tolls one month, packages the next, a fake job after that. The method does not change. If you practice Stop, Check, Verify a few times, it becomes automatic.

Personal Cybersecurity Essentials is a plain-language course for everyday people. It has 7 modules, 27 short lessons, and a quiz at the end of each module. Module 3 covers phishing, scam texts, QR codes, calls, AI scams, fake websites, and the full Stop, Check, Verify method. Every lesson ends with one practical action you can take on your own phone or computer.

$19.99, one-time. Go at your own pace.

Start Personal Cybersecurity Essentials

---

Frequently asked questions

Can you get hacked just by opening a scam text?

For most people, simply opening and reading a text does not give a scammer access. The risk comes from tapping links, downloading attachments, replying, or sharing codes. Keeping your phone updated reduces the remaining risk.

Should I reply STOP to a scam text?

No. Replying tells the sender your number is active. Report the text as junk, forward it to 7726, and delete it.

How can I tell if a link in a text is real?

You often cannot tell by looking, which is why the safest approach is not to use it. Go to the company’s website or app yourself and check your account there.

Do real companies send texts with links?

Yes. That is why scam texts work. The difference is that you can always verify a real message by going to the company directly, and a real company will not ask you to read back a one-time code.

What should I do if I gave a scammer my card number?

Call your card issuer using the number on the back of your card, explain what happened, and ask them to block the card and review recent charges.

Where do I report scam texts?

In the United States, forward them to 7726 and report them to the FTC at ReportFraud.ftc.gov.