A surprise text says your package is delayed, your bank account is locked or you owe a fee. It may look convincing, but tapping its link can expose you to a scam. You can check the claim without using the message’s link or sharing personal information.
This guide walks through a safe way to assess a suspicious text, report it and take practical next steps if you already clicked or replied.
What to do when a text seems suspicious
- Pause before responding. Don’t tap a link, open an attachment, call a number in the text or reply. Scammers can make a message look as though it came from a familiar organization, and pressure to act immediately is a reason to slow down.
- Look for warning signs without interacting. Read the message as it appears on your screen. Be cautious of unexpected requests for payment, passwords, account details or verification codes; alarming threats; prizes you did not enter to win; and links or contact details you weren’t expecting. A familiar-looking sender name or a polished message does not prove it is genuine.
- Check the claim through a separate route. If the text claims there is a problem with an account or delivery, open the company’s official app or type its known website address yourself. You can also use a phone number printed on a bank card, statement or other trusted document. Don’t use contact information supplied in the suspicious text, and don’t search for a number and assume the first result is trustworthy.
- Ask whether the organization can confirm the issue. Sign in through the official app or website, or contact the organization using a trusted number. Check for an account alert or ask whether the message is legitimate. Don’t share a password, one-time code or full payment details with someone who contacted you unexpectedly.
- Report the text, then block it. In the United States, you can forward unwanted or suspicious texts to 7726 (SPAM); your mobile provider can use the report to investigate spam. Many phones also offer a “Report Junk” or similar option. You can report scams to the Federal Trade Commission at ReportFraud.ftc.gov. After reporting, block the sender if your phone offers that option.
- Remove the message safely. Once you’ve reported it and have no need to keep it, delete it. Don’t forward the message to friends or family as a warning with its link intact; instead, tell them about the claim and suggest they verify it through the organization’s official channels.
What if you already clicked?
Clicking a link does not, by itself, tell you whether your device or account has been compromised. The important questions are whether you downloaded anything, entered information or approved a request.
- If you opened the page but did not enter anything: Close it. Don’t download files, install an app or accept prompts from the page. Update your device’s software and security software; the FTC also recommends running a security scan after clicking a phishing link.
- If you entered a password: Go to the real service using its official app or a website address you type yourself, and change the password. If you reused that password on other accounts, change it there too. Turn on two-step verification if the service offers it, and review account activity for changes you did not make.
- If you shared bank or card information or sent money: Contact your bank or card issuer promptly using the number on your card or statement. Explain what happened and ask what steps to take to protect the account. Review recent transactions and report any you don’t recognize.
- If you shared your Social Security number or other identity details: Visit IdentityTheft.gov for guidance on what to do next. If you shared a one-time sign-in code, contact the affected service through its official channel and secure the account.
Things to know
A legitimate company may send texts, but an unexpected message is not proof that the sender is who it claims to be. Caller ID and sender details can be misleading. Treat the message as a prompt to check your account independently—not as a safe place to log in, pay or provide a code.
Also, don’t confuse a suspicious message with a marketing text you recognize and chose to receive. If you’re unsure whether a message is legitimate, avoid replying and contact the company through a channel you find independently.
The safest routine is simple: pause, verify through a trusted route, and report suspicious texts. You don’t have to solve the mystery by clicking the link.
