Is This a Phishing Text? How to Spot a Scam Message
"Your package couldn't be delivered." "Your account is locked." "Is this still your number?" Most scams now arrive as a text message, and they're built to make you tap before you think. Here's how to spot one in a few seconds — no tech skills needed. Good one for the whole family.
Steven once tapped a "your toll is unpaid" text. He doesn't own a car with a transponder. Let's make sure you do better than Steven. — Nyx
Why it matters: a scam text ("smishing") only needs you to tap one link and type something in. The whole trick is urgency plus a link. Learn the tells and you'll catch them before they catch you. For the grown-up version of this, see social engineering and fraud. Spot something wrong? Tell us.
The five tells
- It's urgent. "Act now," "within 24 hours," "final notice." Real companies rarely rush you by text. Urgency is the scammer's main tool — it's there to stop you thinking.
- It has a link — and the link looks off. Hover or long-press the link (don't tap) to see the real address. Scam links use look-alikes: amaz0n-support.com, usps.delivery-track.info. The real company's address is simple and ends in its own name.
- It's from a random number or email. A text from a long weird number, or an email address pretending to be a company, is a red flag. Your bank doesn't text from a Gmail address.
- It wants information or money. A password, a code, card details, a "small fee" to release a package. Stop. No legitimate text needs your password or a one-time code typed into a link.
- It's a service you don't even use. A toll you never drove, a bank you don't have, a package you didn't order. That's a scam casting a wide net.
What to do instead
- Don't tap the link. If you think it might be real, open the company's app or type their website yourself — never through the text's link.
- Never type a code or password into a page you reached from a text. Codes are for you, not for anyone who messaged you.
- Verify a different way. Call the number on the back of your card, or the company's real site — not a number from the text.
- Delete and report. On most phones you can report the message as junk/spam, then delete it.
The golden rule
A real company can wait five minutes while you check. A scammer can't — that's why they rush you. When a message pushes you to act right now, that urgency itself is the warning sign. Slow down, verify a different way, and you win.
If it's urgent, has a link, and you didn't start it — it's a scam until proven otherwise. Screenshot it and quiz Steven. — Nyx
And if you ever tap one by accident, it's okay — change that password and tell a grown-up. Catching it early is the whole game. — Nova