A suspicious text message is safest to treat as phishing until you prove otherwise. The fastest check is to pause, inspect the sender and wording, and verify the claim through a trusted channel you choose, not the link or number in the text. If you already tapped or replied, the next question is what you entered or approved.
Use this five-step rule
- Pause before you tap, reply, or call anything in the message. The goal is to stop the scam from getting a faster response than your judgment.
- Check the sender, wording, urgency, and destination. Look for mismatched names and numbers, odd grammar, vague greetings, scare language, deadlines, and links or numbers that send you somewhere you did not expect.
- Verify the message through a trusted channel you choose. Open the official app, type the company’s website address yourself, or use a known-good number already saved in your contacts or on a real account statement.
- Never share passwords, verification codes, payment details, or personal information by text. If the message asks for any of those, stop and treat that as a red flag until you confirm the request another way.
- Act on the result and recover if needed. If the message is fake, report and block it; if you already clicked or replied, secure the account and check for unauthorized changes. When you finish this five-step check, you should know whether the text is safe to ignore, safe to verify elsewhere, or urgent enough to secure right away.
Pause before you tap anything
Stop before you open a link, attachment, or reply. That short pause keeps a bad SMS from turning into a bigger problem while you inspect it.
If the message feels urgent, that is exactly when you should slow down. Phishing texts often work because they try to make you act first and think later.
Do not click, do not reply, and do not call the number in the text until you have checked it another way.
Check the sender and the ask
Look closely at who seems to be sending the message and what they want from you. Real messages can be masked by display-name tricks, so check the actual number, short code, or sender details if your phone shows them.
Watch for vague greetings like “Dear customer” or wording that sounds off for the company. Also treat requests for passwords, authentication codes, payment details, gift cards, account numbers, or personal information as a major warning sign.
A genuine service may text you a notice, but it usually will not ask you to hand over sensitive information by SMS.
Spot the pressure tactics phishing texts use
Phishing texts often push urgency, fear, or greed. Common pressure lines include account lockout warnings, fake fraud alerts, prize claims, unpaid toll notices, package problems, or threats that something bad will happen if you do not act right now.
Scammers also try to move you off-platform. They may ask you to continue in a different app, visit a random site, or call a number that only appears in the text.
If the message gives you a deadline, says your account will close, or insists you must confirm something immediately, slow down. That kind of pressure is a classic urgent text scam pattern.
Verify it using a channel you trust
The safest verification step is to ignore the text’s link and contact method and check the claim through a trusted channel you choose. Use the official app, the company’s website address that you type yourself, or a known-good number already saved in your contacts or on a real account statement.
If the text claims to be from your bank, sign in through the bank’s official app or website, not the message. If it claims to be from a delivery service, open the company’s app or type the address yourself.
A real-world check is often faster than reading a long list of scam traits. If the trusted channel shows the same issue, you can act on it there; if it does not, treat the text as fake SMS alert material.
If the message might be legitimate but you are not sure, the safe move is to leave the link alone and verify separately. Do not answer the text with sensitive details just to see what happens.
What to do if you already tapped or replied
If you already clicked, do not keep going. Close the page, do not enter more information, and do not download anything it offers.
Next, figure out what you shared. If you entered a password, change it on the real site or official app right away. If you shared a verification code, treat the account as exposed and check for unauthorized logins or changes.
If you entered payment details or other sensitive personal information, contact your bank, card issuer, or the relevant support team as soon as you can. Also watch account activity closely and enable extra security steps, such as app-based alerts or account settings that notify you about sign-ins, if the service offers them.
If the page asked you to approve a login or a payment, review recent activity right away. The key question is not just whether you clicked, but what information you entered or approved.
Report, block, and remember the rule
After you check the message, report it as spam or phishing in your messaging app if that option is available. Then block the sender so you do not have to see the same thread again.
You can also use carrier report tools when your provider offers them, and you can forward scam texts to the reporting number or service your carrier recommends. Because those reporting paths can change, check your carrier’s current instructions instead of relying on an old number from memory.
Keep the rule simple: pause, inspect, verify, act, and recover if needed. If you remember only one thing, remember this workflow: do not click links, verify through a trusted contact method, and treat any request for passwords, codes, or payments as a red flag.
Conclusion
If the text passes the five-step check, it should still be confirmed through a channel you trust before you do anything sensitive. If it fails any part of the check, report it, block it, and do not reply with private information.
Frequently Asked Questions
How can I tell if a text from my bank is real?
Treat it as unconfirmed until you check the bank through its official app, website address you type yourself, or a known phone number you already trust. A real bank message should still be verified that way, because scammers often copy the bank’s tone and warning style.
What should I do if a text asks for a verification code?
Do not share the code unless you started the sign-in or reset yourself and you are entering it in the real service you meant to use. If the request came out of nowhere, assume someone else is trying to access your account and verify it separately.