How to tell if a text message is a scam, and check the link safely

A text message is probably a scam if it creates urgency about a parcel, a payment, an account or a refund, and then asks you to tap a link, call a number or send money or a code. The safe check is to leave the link alone, go to the company through an address you already know, and report the message. You can paste the text into the scam checker first to see the warning signs and the real domain of each link.

Scam message checkerIs this text a scam?Do it free

The patterns that come up most

Most scam texts follow a small number of scripts. The U.S. Federal Trade Commission lists several of them, including fake package delivery notices, claims of suspicious account activity or a payment problem, fake invoices for purchases you did not make, and offers of prizes, gift cards or discounts that are not real.

• Fake delivery fee. A parcel is "held" and you are asked for a small redelivery fee, often a couple of pounds or dollars. The amount is low so you pay without thinking, and the page then asks for your card details.
• Locked account. "Your account has been limited. Verify now." The link goes to a copy of a login page.
• Toll or tax refund. A text about an unpaid toll, or a refund you are owed, with a link to "claim" it.
• "Hi Mum" from a new number. Someone says they have lost their phone and need money today, to a new account.
• Job offers. Pay for a starter kit, buy equipment or crypto to begin, or "like" posts for money.
• Wrong-number romance or investment. A friendly accidental message that moves on to an investment platform that only pays out after you deposit more.

What these have in common is a request for money, codes or details, and a reason to act before you check.

How to read the real domain in a link

A web address has the form https://host/path. The host is the text between the // and the first single slash. Everything before an @ sign is a login name, not the destination. So https://[email protected]/ opens a numeric address, not your bank.

Four tricks catch people out:

• Brand in the subdomain. In yourbank.com.secure-check.net, the real domain is secure-check.net. The part that looks familiar is a name the sender chose. The registered domain is usually the last two parts of the host, or three in places such as .co.uk.
• Numeric addresses. A banking or delivery link that points to a string of numbers is a warning sign.
• Lookalike letters. Internationalised names are stored with an xn-- prefix, and a name can use letters from another alphabet that look almost identical to Latin ones. Read the address, not the logo.
• Shorteners. Services such as bit.ly or tinyurl hide the destination. You cannot judge the link by reading it.

The clean link tool unwraps redirect wrappers such as google.com/url?q= and strips tracking tags, so you can see the address a link really goes to. It does not judge whether that address is safe.

What to do with a suspicious text

1. Do not tap the link, and do not reply to the message. A reply confirms your number is live.
2. If the text claims to be from a company, open its app or type its address yourself, and check the account there.
3. If you already entered card details or a password, contact your bank or card issuer using the number on the card, and change the password.
4. Report the text (see below).

Where to report it

United States. Forward the text to 7726 (SPAM), which the FTC asks people to do. Report the scam to the FTC at ReportFraud.ftc.gov. Your messaging app may also have a "report junk" option.

United Kingdom. Forward a suspicious text to 7726, which is free. Forward a suspicious email to [email protected], the National Cyber Security Centre's Suspicious Email Reporting Service. If you lost money, report it to Report Fraud (formerly Action Fraud) at reportfraud.police.uk.

Forwarding helps the mobile networks and the authorities block numbers and take down sites. You do not need proof that a message is a scam to report it.

Edge cases

• The message came in the same thread as real texts from your bank. Sender names can be faked, so a familiar name is not proof. Check through an address you already know.
• The message is from a company you really use. A real delivery can still be followed by a fake one. Check the tracking in the company's own app.
• You are not sure. Ask someone you trust, or check the company's website for a list of its genuine messages.
• A clean result from the checker. The scam checker uses warning-sign rules, so a clean result does not prove a message is safe. Treat a message that asks for money or codes as suspicious either way.

Quick answers

Can a text from a real company's number be a scam? Yes. Numbers and sender names can be spoofed, and scammers sometimes send messages into an existing conversation. Judge the request, not the name.

Should I reply "STOP" to unsubscribe from a scam text? Usually not. A reply confirms your number is active. Forward the message and delete it.

What if I clicked the link? Do not enter anything on the page. Close it, clear the browser history if you want, and check your bank and card accounts. If you entered details, follow the steps above.