Is this text a scam? Seven things to check before you tap
Most scam texts can be identified by checking the sender, the link domain, the urgency of the request, and whether you were expecting the message at all. When unsure, do not tap the link — contact the company using a number you already have.
Scam texts work by volume. Most people delete them; a few tap. The whole business model rests on catching you in the two seconds before you think.
Here is what to look at, roughly in order of how quickly it settles the question.
1. Were you expecting it?
A delivery notice for a parcel you did not order. A toll charge for a road you did not drive. A bank alert for an account you do not hold. This one check catches most of them, and it needs no technical knowledge at all.
2. Look at the domain, not the words
Scam links use a real-looking name in the wrong place. The part that matters is what sits immediately before the first single slash. In ‘usps.delivery-track.co/xyz’ the real domain is delivery-track.co, not usps. Anyone can put a trusted brand in a subdomain.
3. Check what it wants you to do
Legitimate companies text to inform. Scams text to make you act — confirm, verify, pay a small fee, update details, claim before it expires. A small fee is a common hook because it feels too minor to be worth a fraud.
4. Notice the deadline
Urgency is manufactured. Your package will be returned today, your account will be closed, your prize expires in an hour. Real organisations rarely give you one hour to do anything.
5. Look at the greeting
‘Dear Customer’ from a company that knows your name is a sign. So is a message that gets your name right but nothing else — names leak in data breaches constantly and are not proof of anything.
6. Do not trust the sender number
Sender IDs and phone numbers can be spoofed. A message appearing in the same thread as genuine ones from a company does not make it genuine.
7. When in doubt, go around the message
Do not tap the link and do not call the number in the text. Open the company’s app, or type their address yourself, or call the number on your card or your last paper bill. Going around the message defeats every version of this scam at once.
If you already tapped
- Tapping a link alone is usually not enough to cause harm. Entering details is.
- If you entered a password, change it — starting with your email, because that is how everything else gets reset.
- If you entered card details, call your bank and ask them to freeze the card.
- If you installed something, disconnect from wi-fi and have someone you trust check the device.
Common questions
How can I tell if a text message is a scam?
Check whether you were expecting it, read the domain immediately before the first single slash in any link, and notice whether the message is pushing you to act urgently. Unexpected messages that create a deadline and ask you to confirm details or pay a small fee are almost always scams.
Is it dangerous to just open a scam text?
Opening and reading a text is generally safe. The risk comes from tapping links, entering personal or payment details, calling the number in the message, or installing anything it suggests.
What is smishing?
Smishing is phishing carried out over SMS or messaging apps. The goal is the same as email phishing — to get you to reveal credentials or payment details, or to install malicious software — delivered by text instead.
What should I do with a scam text?
Do not reply or tap anything. Delete it, and if you want, forward it to your carrier's spam reporting number. If it impersonated a company you use, contact that company through their app or a number you already have.