Solution · Technology & Digital Safety · Updated 2026-11-01 · Reviewed by Monirujjaman Monjil

Got a suspicious text message? What to do, and what not to do

Don't tap any link, reply or call a number in the message. Check it through a route you already trust: the company's official app, website or the number on your card. Then report it (forward it to 7726 in the US or UK, or use Report Junk in Messages) and delete it. If you already entered a password or card details, change that password and call your bank straight away.

The problem

What it looks like

A text from a number you don't know, or one that looks like it is from your bank, a delivery company, a tax office or a streaming service, asking you to tap a link, confirm details, pay a small fee or call back urgently.

Who it affects

Anyone with a phone. Scammers send messages in bulk, so receiving one does not mean you were targeted personally.

What it costs you

Stolen account logins, card fraud, money sent to criminals, and personal details sold on to other scammers.

Why it happens

Scam texts aim to get you to a fake website that steals passwords or card details, or to install harmful software. The U.S. Federal Trade Commission lists common lures: fake prizes and gift cards, suspicious activity on your account, problems with your payment details, fake invoices and fake delivery notices.

The UK National Cyber Security Centre describes the pressure tactics scam messages use. Authority: it claims to be your bank, a government department or a well-known company. Urgency: 'within 24 hours', 'your account will be closed'. Emotion: fear, hope or curiosity. Scarcity: a limited offer. Current events: tax season, holidays, big news.

Scam messages used to be easy to spot by bad spelling. The NCSC notes that scams are getting smarter and some even fool experts, so judge the request rather than the presentation. The FTC is direct about this: legitimate companies won't ask for information about your account by text.

Example: 'Your parcel could not be delivered. Pay the £1.45 redelivery fee within 12 hours: [link]'. It uses authority (a delivery firm), urgency (12 hours) and a tiny amount so you don't think twice. The real aim is your full card details.

Common mistakes

Tapping the link 'just to see' whether it looks real.
Replying, even with STOP or to ask who it is, which confirms your number is active.
Calling the number in the message instead of the number on your card or the official website.
Assuming a message is genuine because it appears in the same thread as real messages from that company.
Feeling too embarrassed to report it after tapping a link. Acting fast matters more.

How to fix it, step by step

Stop and don't interact
Don't tap links, don't reply and don't call numbers in the message. The risk comes from acting on it.
Check for the warning signs
Is it claiming authority, rushing you, playing on fear or excitement, offering something scarce, or tied to current events? Is it asking for a password, a code, card details or a payment? Any of these is a reason to verify before doing anything.
Verify through a route you trust
Open the company's own app, type its website address yourself, or call the number on the back of your card or on an official bill. If the message was real, you will see the same alert there.
Report it
In the US and UK you can forward the text to 7726 (SPAM) so your mobile network can investigate and block the sender. In the UK you can also email a screenshot to report@phishing.gov.uk. In the US you can report it at ReportFraud.ftc.gov. On iPhone, use Report Junk under the message.
Block and delete
Block the sender and delete the message so you can't tap it by accident later. Turn on your phone's filter for unknown senders to keep future ones out of your main inbox.
If you tapped or entered details, act now
If you entered a password, change it straight away on the real website, plus any other account using the same password, and turn on two-factor authentication. If you entered card or bank details, call your bank on the number on your card and tell them. Watch your statements for the next few weeks.

Doing it without an app

You do not need to download anything to solve this. Any of these work:

Your bank's or company's official app

Real alerts about your account will appear in the official app too. If they are not there, treat the text as fake.

Ask someone

Before acting on an urgent or upsetting message, show it to a friend or family member. A second pair of eyes breaks the pressure scammers rely on.

Tools that can help

Your phone's built-in spam and unknown-sender filtering
Your mobile network's spam-blocking service
Password managers, which won't fill in your password on a look-alike website
Link and QR checkers, for codes you are unsure about

An app that can help

Qanary: Safe QR Scanner

Some scam texts and emails now carry a QR code instead of a link. If you take a screenshot, Qanary can scan the code from your photo library and check the link inside before anything opens.

Useful for this problem

Scans QR codes from the camera or from screenshots in your photos
On-device Safe, Caution or Danger check for scam and phishing patterns such as look-alike domains
Reveals where a shortened link really goes

Limits to know

It checks links inside QR codes and barcodes. It is not a filter for text messages and does not replace the steps above
A 'Safe' result is not a guarantee. If a message pressures you to log in or pay, verify with the company directly anyway
iPhone and iPad only

iPhone and iPad · iOS 17.0 or later · Free to download. Qanary Pro is a one-time $4.99 — no subscription.

Privacy: Works fully offline by default; Scans, history and documents stay on your device; No ads, no tracking.

Get Qanary Full details →

We make this app. How we decide what to recommend.

Questions

Is it dangerous just to open a scam text?

Reading the message is not the main risk. The danger comes from acting on it: tapping links, replying, calling numbers in it or entering details on a page it sends you to.

My bank texted me about a suspicious payment. Is it real?

It might be, but check it a different way. The FTC advises that legitimate companies won't ask for information about your account by text. Open your banking app or call the number on your card instead of using any link or number in the message.

What does forwarding to 7726 do?

In the UK, the NCSC explains that most phone providers are part of a scheme that lets you report suspicious texts free by forwarding them to 7726, so your provider can investigate and block or ban the sender. In the US, the FTC also recommends forwarding unwanted texts to 7726 so your wireless provider can spot and block similar messages.

I tapped the link but didn't enter anything. What now?

Close the page and don't enter any details. Delete the message and report it. Keep your phone's software up to date. If you notice anything unusual afterwards, such as unexpected logins or payments, change your passwords and contact your bank.

Why do I keep getting these?

Scammers send messages in huge batches to numbers that are generated or leaked, not because of anything you did. Reporting them helps your network block the senders.

Sources

How to Recognize and Report Spam Text Messages, U.S. Federal Trade Commission
How to spot a scam email, text message or call, UK National Cyber Security Centre
Report a scam text, UK National Cyber Security Centre
Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams, Apple Support

Checked 2026-11-01. Found a mistake? Tell us. Read our editorial policy.

Related guides

QR code scams: how to spot a fake QR code before you scanHow QR code scams work on parking meters, posters, emails and parcels, the warning signs, and how to check a QR link safely before opening it.
How to check if a link is safe before you open itSimple checks to tell a safe link from a phishing link — look-alike domains, shortened links, urgent messages — before you tap.